Hackers are stealing Google account passwords using a new phishing attack that is hard to catch with traditional heuristic detection, warns security firm Bitdefender.