They did that by asking a logged-in user to grant access to a malicious app posing as Google Docs.
@malicious /mə'liʃəs/* tính từ- hiểm độc, có ác tâm- có hiềm thù