Zach Herring zherring

g.co, Google's official URL shortcut (update: or Google Workspace's domain verification, see bottom), is compromised. People are actively having their Google accounts stolen.

Someone just tried the most sophisticated phishing attack I've ever seen. I almost fell for it. My mind is a little blown.

Someone named "Chloe" called me from 650-203-0000 with Caller ID saying "Google". She sounded like a real engineer, the connection was super clear, and she had an American accent. Screenshot.
They said that they were from Google Workspace and someone had recently gained access to my account, which they had blocked. They asked me if I had recently logged in from Frankfurt, Germany and I said no.
I asked if they can confirm this is Google calling by emailing me from a Google email and they said sure and sent me this email and told me to look for a case number in it, which I saw in

	/**
	* Generates an image in PNG format and returns it as a base64-encoded string.
	*
	* @param colors - An array of color values
	* @param pixels - An array of pixel values
	* @param width - The width of the image
	* @param height - The height of the image
	* @param scale - The scale factor to apply to the image (default: 1, uses nearest-neighbor interpolation)
	* @returns The base64-encoded string representation of the generated image
	*/

	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
	<plist version="1.0">
	<array>
	<dict>
	<key>phrase</key>
	<string>★☆☆☆☆</string>
	<key>shortcut</key>
	<string>/1star</string>
	</dict>