Google AdWords phishing scam seeks to hook usernames and passwords

Customers of Google's AdWords platform are advised to be on the lookout after the discovery of a phishing scam targeting the service.

Security firm Sophos has discovered a series of phoney emails which claim to be from AdWords administrators.

The emails advise customers that their accounts are in danger of being shut down if they do not visit a 'verification page' to check their credentials.

The messages contain a link to an external page that purports to be a Google AdWords site requesting the customer's username and password.

"It's a realistic replica of the main Google AdWords page, created with some care in an attempt to phish your credentials off you," wrote Sophos senior technology consultant Graham Cluley in a blog post.

"And don't forget, your same username and password will not just be used by Google AdWords, but by Gmail, Google Docs, Google+ and so forth."

The attack is the latest in what security experts see as a trend among cyber criminals towards harvesting user account data.

IID chief technology officer Rod Rasmussen said in an interview with V3 that poor security practices mean that one set of harvested credentials can often be used to take over accounts on multiple sites and web services.

"The bad guys are getting a lot more sophisticated about how they are able to take one starting point and then take more resources," he said. "A lot of places have already been broken into and they take that information and get into other places."