Google is urging users to enable a setting on their accounts to block worrying new attack.