Reddit Scam Pattern
Compromised colleague email accounts enabling Google credential harvesting
8 reports · first seen 13 July 2026 · last seen 21 Aug 2026
Attackers use hijacked colleague or friend email accounts to send fake event invitations or document-sharing links, directing recipients to pages that request Google credentials or prompt OAuth re-authentication. Victims surrender Gmail account access believing the communication originates from a known contact.
How the scam works
Compromised peer email accounts distribute fake invitations or document links that redirect to Google OAuth phishing pages for credential or session token capture.
Brands impersonated
Member posts on Reddit (8)
- [US] Email invitation scam?
Victim clicked an invitation from a friend's email, entered Google credentials on a fake login page, and woke to find their account had been used to contact their contacts.
reddit · 21 Aug 2026 · phishing
- [US] Close call with Fake Evite OAuth phishing
Victim received a convincing fake Evite from a real friend's address linking to evite.lat, which attempted to harvest Google credentials via a fake OAuth prompt.
reddit · 21 Aug 2026 · phishing
- Gmail Phishing - fake email sent to a family member from my draft folder
A Gmail user's compromised account sent phishing emails to a family member directly from the victim's draft folder, suggesting active session access by an attacker.
reddit · 16 Aug 2026 · phishing
- Fell for a fake google meeting, can you check payload?
A user fell for a fake Google Meet invitation that contained malicious t.co redirect links and sought help analysing the payload.
reddit · 12 Aug 2026 · phishing
- (US) Google account was compromised last night - need to know what they were after and what they might do
Victim clicked a phishing link in what appeared to be an email from their niece, unknowingly logging into a fake site and compromising their Google account.
reddit · 13 Aug 2026 · phishing
- Fell for the Punchbowl/Paperless Post Gmail scam, anyone compromised but had nothing stolen/sent?
Victim clicked a Paperless Post link sent from a friend's compromised Gmail, authenticated via Google OAuth, and had their Gmail account accessed for approximately 22 hours.
reddit · 13 Aug 2026 · phishing
- [Canada] Project Proposal Scam
A phishing email impersonating a colleague used a fake Google Docs button to direct the poster to a credential-harvesting page.
reddit · 3 Aug 2026 · phishing
- Got an Email from a colleague for an event invite, I clicked the link and it’s a scam
A user clicked a fake event invitation from a compromised colleague's email and was directed to a credential-harvesting page asking for their Gmail password.
reddit · 6 July 2026 · phishing