Was the target of a fairly sophisticated multi-vector spearphishing attack yesterday. Started with multiple calls from a US number, with pre-recorded messages from an American accented woman's voice saying my Google account login had failed. 
As soon as I disconnected the call, I received cleanly formatted SMSes from a shortcode number, saying I needed to reauthenticate. There was a link, to a goo.gl shortcode.
Out of curiosity, I opened the shortcode from a different device. Which led to this fairly sophisticated page.
Notice how my name and email id are hard-coded into the login page, to make it look as though they were pre-filled in from earlier login sessions. But here's the thing, I do not sign in to Google services except from one browser. So I knew these were hard-coded.
The URL of course was another giveaway. But given that most lay users do not bother to read URLs and many browsers increasingly hide URLs as unnecessary detail, I wonder how many will notice.
The site's security certificate was valid too. Using a Letsencrypt cert. Look at the various subdomains it uses to target people.
Lastly, when I entered my true password, "thisisasecretpasswordpleasedonotshare1234", it threw up a very real looking error message. Presumably to get me to reenter my password.
To recap, multiple international phone calls followed by multiple SMSes followed by hard-coded login pages with my name and email id. They had my name, email id, phone number etc. This was targeted. I wonder why, and I wonder who. /Fin.
