people via email to encourage them to hand over private or sensitive information about themselves or the company they work for . “ The most prevalent threats we see targeting consumers today are phishing attacksAttack.Phishingpredominantly via email , where scammers try to trickAttack.Phishingpeople into sharing private information or access to money , ” Jessica Brookes , director of EMEA consumer at McAfee , told the Press Association . “ The first thing you should know about phishingAttack.Phishingis that it almost always involves a form of ‘ social engineering ’ , in which the scammer tries to manipulateAttack.Phishingyou into trusting them for fraudulent purposes , often by pretending to beAttack.Phishinga legitimate person or business . Secondly , if an email doesn ’ t seem legitimate , it probably isn ’ t ; it ’ s always better to be safe than sorry. ” Here are four of the most popular scams circulating today : 1 ) The CEO Scam This scamAttack.Phishingappears asAttack.Phishingan email from a leader in your organisation , asking for highly sensitive information like company accounts or employee salaries . The hackers fakeAttack.Phishingthe boss ’ s email address so it looks likeAttack.Phishinga legitimate internal company email . That ’ s what makes this scam so convincing – the lure is that you want to do your job and please your boss . But keep this scam in mind if you receive an email asking for confidential or highly sensitive information , and ask the apparent sender directly whether the request is real , before responding . 2 ) The Lucky Email How fortunate ! You ’ ve won a free gift , an exclusive service , or a great deal on a trip abroad . Just remember , whatever “ limited time offer ” you ’ re being sold , it ’ s probably a phishing scamAttack.Phishingdesigned to get you to give up your credit card number or identity information . The lure here is something free or exciting at what appears to be little or no cost to you . 3 ) The Urgent Email Attachment Phishing emails that try to trickAttack.Phishingyou into downloading a dangerous attachment that can potentially infect your computer and steal your private information have been around for a long time . This is because they work . You ’ ve probably received emails asking you to download attachments confirming a package delivery , trip itinerary or prize . They might urge you to “ respond immediately ” . The lureAttack.Phishinghere is offering you something you want , and invoking a sense of urgency to get you to click . 4 ) The Romance Scam This one can happen completely online , over the phone , or in person once initial contact is established . But the romance scam always starts with someone supposedly looking for love . The scammer often poses asAttack.Phishinga friend-of-a-friend via email and contacts you directly . But what starts as the promise of love or partnership , often leads to requests for money or pricey gifts . The scammer will sometimes spin a hardship story , saying they need to borrow money to come visit you or pay their phone bill so they can stay in touch . The lure here is simple – love and acceptance . Brookes added : “ It is everyone ’ s responsibility to be aware and educate each other – we need to share knowledge and collaborate to protect ourselves against the current threats we face as people living in a connected world . ”
We got several reports ( thanks to Seren Thompson , Tahir Khan and Harry Vann ) about OAUTH phishing attacksAttack.Phishingagainst Google users . The phishing attackAttack.Phishingarrives , of course , as an e-mail where it appears that a user ( potentially even one on your contact list , so it looks very legitimate ) has shared a document . If you click on the link ( Open in Docs ) , you will be redirected to the OAUTH2 service on accounts.google.com , it appears asAttack.PhishingGoogle Docs wants full access to my Gmail as well as my contacts . Of course , this is not real Google Docs – the attacker has simply namedAttack.Phishinghis “ application ” Google Docs – this can be verified by clicking on the Google Docs text where the real web site behind this and developer info is shown : Obviously , once you allow access it is game over - the attacker probably uses the phishied Gmail account to further distributeAttack.Phishingphishing e-mails - we 'll see if we can get more details . So far at least the following domains are included : googledocs.g-docs.win googledocs.g-docs.pro The domains are definitely malicious – the URL leads to jsserver.info where a fake alert that the computer is infected is shown . UPDATE : There are more domains - they all just change the TLD 's for googledocs.g-docs.X or googledocs.docscloud.X . Most of them ( if not all ) appear to have been taken down ( thanks @ Jofo ) . It also appears that Google has reacted quickly and are now recognizing e-mails containing malicious ( phishing ) URL 's so the message `` Be careful with this message . Similar messages were used to stealAttack.Databreachpeople 's personal information . Unless you trust the sender , do n't click links or reply with personal information . '' will be shown when such an e-mail is opened .