Malicious automated activities are hijacking accounts and then direct mentioning 30 to 40 accounts preceded by a URL that is a Google domain followed by a share dot google (URL-shortened) link (eg google.tld/share.google?q=VALUE)

IFTAS will refer to this activity as #sharegoogleSpam

This page will track helpful posts and mitigations for administrators and end users. See below.

DO NOT CLICK/TAP ANY LINKS ASSOCIATED WITH THESE MESSAGES – there are reports of these links serving malware.

For Administrators

https://infosec.exchange/@jerry/117457041484080186

https://social.lol/@neatnik/117456567939745803

For End Users

• Report any account you see posting these notices.
• If you believe your password may have been compromised (or if you re-use passwords) change your password. Longer is better than complex.
  • You can check to see if password associated with the email address you used to create your account has been compromised: https://haveibeenpwned.com/
• Where possible, use a password manager to ensure you use a unique password for every Internet service you use. EFF has good guidance on this decision.
• Add two factor authentication (“2FA”/ “MFA”) to your account if your service supports it.
• If your service supports filtering/hiding messages, filter “share.google” or “/share.google?” – but be aware this will filter/hide messages that contain non-malicious links from other people who use Google products to share links online.

Something To Add?

If you have specific guidance for Administrators or End Users you’d like IFTAS to review, please send it to @iftas or contact@iftas.org for review, please include the hashtag #sharegoogleSpam