My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of medical ads on. She closed the page and deleted the email.
She did not notice anything else happen when she clicked the link. For example, she did not see a download start and did not click anything on the page that opened.
The URI of the link she clicked was hxxp://23.88.82.34/d/?sururopo=duti&bugenugamaxo=aGViZTFzaGViZUBob3RtYWlsLmNvLnVr&id=anVuYWx4QGdvb2dsZW1haWwuY29t&dokofeyo=anVuYWx4
[DON'T visit that address!]
Immediately (although she didn't know at the time) about 75 emails were sent from her Gmail address to a selection of her contacts. They are visible in the Sent Mail list in her Gmail account. This happened between 17:08 and 17:10 GMT. Here the source of one:
Return-Path: <[email protected]>
Received: from localhost (host86-152-149-189.range86-152.btcentralplus.com. [86.152.149.189])
by mx.google.com with ESMTPSA id r1sm16019263wia.5.2014.02.23.09.10.15
for <[email protected]>
(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
Sun, 23 Feb 2014 09:10:16 -0800 (PST)
Message-ID: <[email protected]>
Date: Sun, 23 Feb 2014 09:10:16 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
From: [email protected]
Return-Path: [email protected]
Subject: Bar gain
<span style=3D"VISIBILITY:hidden;display:none">Mount your brooms said Madam=
Hooch Three two one =20
</span><br /><u>[email protected] has sent you 3 offline broadcast</u><=
br /><a href=3D"hxxp://23.88.82.8/d/?ba=3Djurofaxovu&maremiditigehavuve=3Da=
nVuYWx4QGdvb2dsZW1haWwuY29t&id=3DaGVsZW5fY19odWdoZXNAaG90bWFpbC5jb20=3D&guv=
iwafaloco=3DaGVsZW5fY19odWdoZXM=3D" >Locate Full Email Content</a>
Here's the Gmail "Activity information" window:
Type | Origin | Timestamp |
---|---|---|
SMTP | United Kingdom (86.152.149.189) | 17:10 (1.5 hours ago) |
SMTP | United Kingdom (86.152.149.189) | 17:10 (1.5 hours ago) |
SMTP | United Kingdom (86.152.149.189) | 17:10 (1.5 hours ago) |
SMTP | United Kingdom (86.152.149.189) | 17:10 (1.5 hours ago) |
SMTP | United Kingdom (86.152.149.189) | 17:10 (1.5 hours ago) |
SMTP | United Kingdom (86.152.149.189) | 17:10 (1.5 hours ago) |
Note that the IP address in that list, 86.152.149.189, is the same as in the header of that email.
One of my mum's friends reports that she received one of the emails and clicked on the link in it. She says that her email account then sent out a load of emails too.
I don't know what my mum's IP address was at the time this happened. So maybe it was 86.152.149.189.
I don't understand how this happened. She had an impressively strong password (which I've now changed) that she doesn't use for anything else and she didn't type this password into the page that opened.
How on earth could clicking a link in an email allow an attacker authenticate themselves with the Gmail SMTP server as my mum and then to send a load of emails as her to her contacts? And how could it have got the addresses of her contacts?
Update subsequent to Iserni's answer:
My mum confirms that she did indeed enter her Gmail password when "Gmail" asked for it after the page of medical ads closed. Her aunt received one of the emails and was also asked to enter her Gmail login details. She says she did because the original email came from my mum. Clever attack.