Google warns Gmail users of state-sponsored attacks

Google will start warning users that might be targeted by state-sponsored attackers with clear alerts that pop up above their Gmail inboxes no matter what browser they use (click on the screenshot to enlarge it):

“We are constantly on the lookout for malicious activity on our systems, in particular attempts by third parties to log into users’ accounts unauthorized. When we have specific intelligence—either directly from users or from our own monitoring efforts—we show clear warning signs and put in place extra roadblocks to thwart these bad actors,” explained Eric Grosse, VP Security Engineering at Google.

He points out that not all of the users who see the warning had had their Google account hijacked, but that Google believes they may be a target.

Still, the company is not ready to share details about why specific users get warned.

“You might ask how we know this activity is state-sponsored. We can’t go into the details without giving away information that would be helpful to these bad actors, but our detailed analysis—as well as victim reports—strongly suggest the involvement of states or groups that are state-sponsored,” Grosse concluded.

The alert includes a link to a Google Help page that gives some indications of why the alarm was triggered.

“It’s likely that you received emails containing malicious attachments, links to malicious software downloads, or links to fake websites that are designed to steal your passwords or other personal information,” it says on the page, but Google is also sure to say that its internal systems haven’t actually been compromised, and that the alert does not refer to one specific campaign.

Users are then advised to secure their account immediately by creating a unique password, enabling 2-step verification as additional security, and updating their browser, operating system, plugins, and document editors, and to keep an eye out for fake Google sign-in pages.

This is not the first time Google has begun notifying its users of possible account hijacking. Following the high-profile Aurora attacks that targeted Google and a great number of its users, the company has begun popping up similar alerts.

Also, very recently, Google started warning its users about an active malware infection when they believe their computers have been compromised with the DNSChanger Trojan.