I'm looking for information on scams that target GMail users. I believe I found an article that discusses the attack in the context of bank fraud at Warning over text message scam that allowed 'smishing' fraudsters to steal £70,000 from pregnant woman's bank account.
The attack I have seen appears to be very similar. A phone number is spoofed and a text message arrives that appears authentic. The message even shows on a thread of the real person. But instead of stealing money, access to a GMail account is gained.
The user has an Android phone and it is fully patched. It is still under contract so I don't believe it has been abandonware'd. She also has Gmail on with two factor authentication enabled. She was [presumably] logged in, and I believe Gmail uses auth tokens/cookies that never expire.
Later, a relative of the woman received an email message trying to entice the new victim. The thing that struck me was, the attack originated in SMS then switched to email for the new victim.
This is where I need information. How does clicking on a link in a text message yield access to a GMail account? Is this simply stealing an authentication cookie through XSS and policy violations? Or is this just an instance of a confused deputy, where the email program sent an email message on behalf of the sms program? Or is there something else going on like an active vulnerability?