Detailing a phishing attack: Nyasher, a Google account-takeover kit

A phishing email landed on a mailing list I'm on. Google had scanned the attachment and called it safe. It wasn't: behind it was a live Browser-in-the-Middle kit that steals your Google session in real time and walks straight through two-factor. Here's what was hiding behind the blob URL, and how it builds on what other researchers have found.