Pe Jota yes, it’s going around everywhere. Known sender, bad link gives full auth to google account