[Groxx]

I'm not sure what happened here:

>... which asked for Google Apps credentials before redirecting to the Gmail inbox.

followed by:

>Coming from a trusted address, many staff members clicked the link, but most refrained from entering their login credentials.

Does this mean "[asking] for Google Apps credentials" should be read as "put in their Google username and password", or should it be "gave the site OAuth access to their Google account"?

I'm a bit curious, because it sounds like they set up a Google Apps app that sent phishing emails from the first-round-phished accounts to others in the company, so it looked more legit, but this second-round email was not the same as the first. I haven't heard of that trick before, but it's clever, and probably hard to work around.

But if they actually entered their user/pass, there's an easy solution. USE A PASSWORD MANAGER. Kills phishing dead, since it won't auto-fill on the wrong domain.