Recently I was targeted by an sophisticated (Google) phishing attack (opens in new tab)

(threadreaderapp.com)

5 pointsmikexstudios11mo ago1 comments

1 comments

> Next, they create a Google OAuth application. For the name of the application, they enter the entire text of the Phishing message - newlines and all - followed by a lot of whitespace, and "Google Legal Support".

So the meat of the issue is.. Google allows very long oauth application display names, which can look like an email body when they send notifications about that application?

In Microsoft-land this field ("display name") is limited to 120 characters.

j / k navigate · click thread line to collapse

1 comments

parliament3211mo ago

So the meat of the issue is.. Google allows very long oauth application display names, which can look like an email body when they send notifications about that application?

In Microsoft-land this field ("display name") is limited to 120 characters.

j / k navigate · click thread line to collapse