Experts reacted to a Google Docs phishing attack that hijacked Gmail accounts and spammed contact lists. Google shut down the attack but not before it affected an estimated one million users.

Google said in a statement it has disabled the aberrant accounts, which represented less than 0.1% of about one billion Gmail users. "We've removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again."

The phishing attack's significance may lie in not how it spread, but in how it didn't use malware or fake websites to dupe users into giving up passwords, and in fact, didn't even need victims to type in their passwords.