Google AdWords phishing attempt


MX Lab, http://www.mxlab.eu, intercepted a phishing campaign, targetting Google AdWords. The phishing emails comes from the spoofed email address “adwords-noreply@google.com” and has the subject “Account has stopped running this morning”.

The body of the email:

The URL points to hxxp://www.google-hs.com/accounts/?ServiceLogin?service=adwords&hl=en_US and this will redirect visitors to hxxp://adwords.google-oa.net/adwords/?ServiceLogin?service=adwords&hl=en_US