You're minding your own business, just checking email, when you get an email from a "friend" inviting you to get a shared Google Doc file.
You're a student of security, or at least a fan, so you're always skeptical when you receive an email with a link or attachment. This one appears to come from someone you know. The subject and body of the message seem consistent with a Google doc sharing message.
Problem clue #1 - look at the "To:" line. Clearly, this message wasn't sent to you.
Problem clue #2 - were you expecting this email and file? Has this sender sent you Google docs in the past? Did this email arrive at work or home - and do you normally use Google docs there?
But, you are rushed and don't have time to send your friend a message to see if this email is legit. So you click. If you're not already logged in to your Google account, you're asked to log in. What you see next is...
