Google Warns Users of New Email and Microsoft Teams Phishing Scam

Google has issued a warning about a sophisticated online scam targeting users through email and Microsoft Teams. The scam begins when attackers flood a user's inbox with a large number of spam emails. This sudden influx creates the impression that something is wrong with the victim's account.

Key Highlights

• Google warns users of a new phishing scam using email and Microsoft Teams.
• Attackers flood inboxes with spam then pose as IT support on Microsoft Teams.
• Victims are tricked into entering credentials on a fake login page.

How the Scam Operates

Security researchers have identified a group called UNC6692 as the source of this attack. After the spam email wave, the attackers contact the victim via Microsoft Teams. They pose as IT support staff and claim to know about the email issue. The attackers then offer to help resolve the problem.

To proceed, they send a phishing link through Microsoft Teams. The link leads to a page that closely resembles a legitimate login portal. Victims are instructed to enter their email and password to perform a quick check. The first login attempt always fails, which is designed to build trust in the authenticity of the site. On the second attempt, the site captures the victim's credentials without their knowledge.

Risks and Consequences

Once the attackers have the login details, they can access the victim's email account and potentially take control of their device. The scam may also install hidden tools, allowing attackers to maintain access, collect more information, and escalate their control over the system.

By the time the victim sees a success message, the attackers may already have compromised the account. This method makes detection difficult and increases the risk of further data loss or unauthorized access.

How to Stay Safe

Users can protect themselves by staying alert to unusual email activity and unsolicited contact from supposed IT staff. Always verify the identity of anyone requesting sensitive information, especially through unexpected channels like Microsoft Teams. Avoid clicking on suspicious links and never enter login credentials on unfamiliar websites.

Security experts recommend enabling multi-factor authentication and regularly updating passwords to reduce the risk of account compromise. If you suspect you have been targeted, change your passwords immediately and notify your organization's IT department.