An attacker is using ‘Google.com’ to deliver and execute their own code in a weaponized Google OAuth attack.