https://about.iftas.org/2026/10/17/share-google-spam/
using this hashtag: #sgSpam
Malicious automated activities are hijacking accounts and then direct mentioning 30 to 40 accounts preceded by a URL that is a Google domain followed by a share dot google (URL-shortened) link (eg google.tld/share.google?q=VALUE)
IFTAS will refer to this activity as #sgSpam
This page will track helpful posts and mitigations for administrators and end users. See below.
**DO NOT CLICK/TAP ANY LINKS ASSOCIATED WITH THESE MESSAGES** – there are reports of these links serving malware.###
For Administratorshttps://infosec.exchange/@jerry/117457041484080186
https://social.lol/@neatnik/117456567939745803###
For End UsersAdd two factor authentication to your account if your service supports it. If you believe your password may have been compromised (or if you re-use passwords) change your password. Longer is better than complex.
- You can check to see if password associated with the email address you used to create your account has been compromised: https://haveibeenpwned.com/">https://haveibeenpwned.com/
Where possible, use a password manager to ensure you use a unique password for every Internet service you use. https://ssd.eff.org/module/choosing-the-password-manager-that-s-right-for-you">EFF has good guidance on this decision. If your service supports filtering/hiding messages, filter “share.google” or “/share.google?” – but be aware this will filter/hide messages that contain non-malicious links from other people who use Google products to share links online. ###
Something To Add?If you have specific guidance for Administrators or End Users you’d like IFTAS to review, please send it to IFTAS (npub1y2r…kvzk) or contact@iftas.org for review, please include the hashtag #sgSpam
