We found a new phishing site today targeting Gmail usernames and passwords. The site (gmail-security.com) uses authentic parts of the Gmail website and one of the few things that unsuspecting users might notice is the unofficial Google domain and some minor aesthetic differences. If credentials are entered into the site a POST will be sent via load.php and then a forward to the official Gmail site is made.
Here is what the “gmail-security” phishing site looks like:
Here is what the official Gmail site looks like:
