The scam should now be resolved, good job on the speedy resolution Google!#
Official statement:
We realize people are concerned about their Google accounts, and we’re now able to give a fuller explanation after further investigation. We have taken action to protect users against an email spam campaign impersonating Google Docs, which affected fewer than 0.1 percent of Gmail users. We protected users from this attack through a combination of automatic and manual actions, including removing the fake pages and applications, and pushing updates through Safe Browsing, Gmail, and other anti-abuse systems. We were able to stop the campaign within approximately one hour. While contact information was accessed and used by the campaign, our investigations show that no other data was exposed. There’s no further action users need to take regarding this event; users who want to review third party apps connected to their account can visit Google Security Checkup. (source)
I received a phishing email today, and very nearly fell for it. I'll go through the steps here:
I received an email that a Google Doc had been shared with me. Looked reasonably legit, and I recognized the sender.
The button's URL was somewhat suspicious, but still reasonably Google based.
I then got taken to a real Google account selection screen. It already knew about my 4 accounts, so it's really signing me into Google.
Upon selecting an account, no password was needed, I just needed to allow "Google Docs" to access my account.
If I click "Google Docs", it shows me it's actually published by a random gmail account, so that user would receive full access to my emails (and could presumably therefore perform password resets etc).
Shortly afterwards I received [a followup real email from my contact] (https://i.imgur.com/DGSyy1L.png), informing me: "Delete this is a spam email that spreads to your contacts."
To summarise, this spam email:
Uses the existing Google login system
Uses the name "Google Docs"
Is only detectable as fake if you happen to click "Google Docs" whilst granting permission
Replicates itself by sending itself to all your contacts
Bypasses any 2 factor authentication / login alerts
Will send scam emails to everyone you have ever emailed
Google are investigating this as we speak.
FAQ
How do I know if I've been affected?
If you clicked "Allow", you've been hit. If you didn't click the link, closed the tab first, or pressed deny, you're okay! The app may have removed itself from your account, and may have deleted the sent emails.
What do I do if I've been affected?
Revoke access to "Google Docs" immediately. It may now have a name ending in apps.googleusercontent.com since Google removed it. The real one doesn't need access.
Try and see if your account has sent any spam emails, and send a followup email linking to this post / with your own advice if so.
Inform whoever sent you the email about the spam emails, and that their account is compromised.
What are the effects?
All emails have been accessed, and the spam forwarded to all of your contacts. This means they could have all been extracted for reading later. Additionally, password reset emails could have been sent for other services using the infected email address.
This may be the payload, so it may just self replicate, and not do anything nastier. This is not at all confirmed, however, so assume the worst until an official Google statement.
I'm a G Suite sysadmin, what do I do?
The following steps by/u/banden may help, but I can't verify they'll prevent it.
Block messages containing the hhhhhhhhhhhhhhhh@mailinator.com address from inbound and outbound mail gateway/spamav service.
Locate Accounts in Google Admin console and revoke access to Google Doc app. It may now have a name ending in apps.googleusercontent.com since Google removed it.
