Gmail scam so real, even Google didn’t catch it

Gmail users are being targeted by a fresh phishing scam that is so realistic it even evades Google’s own email security measures. The attack impersonates official Google communication and employs trusted platforms to deceive users into divulging sensitive login credentials.

The scam was exposed when Nick Johnson, an Ethereum fan and software programmer, tweeted about his experience. He was contacted via email by no-reply@google.com that a subpoena had been requested on his account information. The email was as shocking as it was authentic. It was correctly signed via Google’s DKIM protocol, consistent with past Google alert threads, and looked perfectly valid.

What made this attack different was that it utilized sites.google.com, a Google-owned platform for public page hosting. The email contained a link to what appeared to be a normal Google support page. What happened instead was that it opened up a spoofed login screen that looked almost identical to the actual one and was meant to steal login credentials.

How Gmail scam happened?

The attack employed a number of sophisticated techniques:

• A very familiar and familiar sender address
• Authenticated email authentication (DKIM and SPF)

Hosting on a genuine Google subdomain

Security experts are labeling this a new wave of phishing. It is the intersection of technical precision and psychological manipulation, one that makes it hard even for careful users to spot.

Google has moved to address the concern, assuring that it is looking into it and developing measures to block the abuse through this means. While the tech giant secures itself, users should take extra measures to secure their accounts.

Here’s how you can protect yourself:

• Turn on two-factor authentication (ideally with passkeys or an authenticator app)
• Don’t click on links in emails you did not expect
• Enter web addresses directly into your browser rather than clicking on embedded links
• Be wary even when emails are otherwise professional-looking

This case is an obvious reminder that phishing methods are changing rapidly. When cyber attackers utilize trusted portals and tools for impersonating authoritative notifications, each user is under threat. Becoming aware and vigilant is crucial now more than ever.

Also, see:

Google Holds Illegal Monopolies in Ad Tech, US Judge Finds