Google accounts face new threats from credential theft and CSS attacks

Cybercriminals have developed new techniques to compromise and steal synchronized access keys from Google accounts, posing a significant threat to digital identity security. These methods specifically target the mechanisms used to synchronize credentials across various devices.

Additionally, security research presented at Black Hat USA revealed vulnerabilities in popular webmail services. Using Cascading Style Sheets (CSS) attacks, researchers demonstrated how attackers could bypass defenses to extract passwords and security tokens directly from user interfaces. While technically feasible, there are currently no reports of active criminal exploitation of this specific CSS vulnerability. Affected providers include Gmail, Outlook, Yahoo, AOL, Fastmail, and Proton Mail.

Beyond technical exploits, there is a rising trend in hybrid attacks. Google has warned of social engineering campaigns involving targeted phone calls to employees in the financial sector, aiming to steal passwords from staff at firms such as Blackstone, Apollo, and KKR.