Warning to all Gmail, Yahoo and Microsoft users

Legitimate authentication services like Gmail, Yahoo, and Microsoft are being targeted by new attacks. Users of these email services have received a warning about a new dangerous phishing attack, through which attackers steal login details and gain access to their accounts.

The attack "bypasses two-factor authentication (2FA) through session hijacking and capturing credentials in real time," researchers at SlashNext, who identified the scam, have discovered, according to The Sun.

The scammers first send users a link via email, which infects their device once they click on it. This link then redirects users to a malicious server, which appears as a fake login page.

This fake page mimics the real login page, making it very difficult to distinguish it as a scam. The situation is made even more dangerous because no security warnings appear, leading many users to believe they are on the official site. Once users enter their credentials, they unknowingly give the scammers access to their accounts.

This new phishing campaign, known as Astaroth, not only captures login credentials, but also "rapidly captures two-factor authentication (2FA) codes and cookies as soon as they are generated," the researchers point out.

This allows attackers to bypass 2FA protection “with great speed and accuracy.” So, even if you are sent an SMS code to log into your account, attackers can capture it in real time. /Telegraph/