Unfortunately, some idiotic companies actually do use non-standard domain names.

For example, my Citi credit card uses "accountonline.com" as the login page. With things like that, "googledrive.com" seems less suspicious.

So to anyone building for the web: please use a single, canonical domain name!

https://googledrive.com is Google! It's hosted with Google drive (like dropbox can do). So this is one case where it would pay not to use the same domain, actually.

Edit: Also important because that way password autofill won't automatically fill in your details.

That's a major security flaw.

On the plus side, looks like your report worked. As of a few minutes after you posted, the link says it's a phishing scam.

Actually that's a feature, now anyone can host a simple webpage without any hassle the fact that this dude figured out a way around it is kinda cool but I'd rather they not remove this bec of phishing attacks.

On the other hand I can see how THIS specific attack is very dangerous: people might assume that they need to login to google to see the content hosted by google....

I very nearly entered my creds just by instinct it looks truly legit, just so you know now chrome stops you from going there (you need to admit to being an idiot before you can move forward)

I tried to submit the form but Safari warned me that it wasn't being submitted securely. I wonder if they use JS to detect what you're typing in before it's submitted.

Of course its possible to capture a users screen as soon they visit a page. Check mouseflow or gamooga secondscreen

Re: 2-factor auth:

Couldn't the app try to login, detect the 2-factor, and ask you for that in the response?

Yes it could.

However it would only have 60 seconds (30 + 30 sec) to forward that to Google along with your credentials. It cannot be done via the user's browser due to forgery protection on Google's end, so a third party piece of software would have to grab the credentials including 2f code and log in using a "browser" (e.g. WebKit engine).

One challenging problem is for the site to know if it should prompt you for the 2f code. It won't know until it tries to login, and it won't be able to try and login until it forwards your credentials to a third party piece of software and then gets a reply back. Even assuming this is done very fast, it could still take a few seconds, in particular if Google starts to throttle their client's IP.

It would likely be easier just to target low hanging fruit (i.e. non-2F people) unless this is a targeted attack.

I don't know whether this will be possible or not. Would love to know that.

Holy Shit. It looks damm original

the only give away is the ')); characters in the bottom left of the screen

I totally missed that because of my screen resolution. I need to scroll to see that.

Goodness I'd have even gotten busted by that. That's quite clever.

I would love to know the technical details behind the creation of this page.

It's just a webpage hosted on Google Drive:

https://support.google.com/drive/answer/2881970?hl=en

Regarding the contents of the page itself:

first layer of obfuscation document.write's a script tag to include "aa.js" which document.write's the main phishing page itself, which sends contents directly to a hacked WordPress site ( cairngormsagainstpylons dot org ).

Reported via Google Drive abuse as a phishing page.

wow this is ridiculous