Beware of this sneaky Google phishing scam

Phishing scammers are now posing as Google, sending out urgent emails from what looks like "[email protected]," claiming there's a subpoena from "law enforcement" about the recipient's Google Account. *Bleeping Computer* reveals that these fraudsters are using Google's "Sites" platform to craft convincing phishing emails and websites, designed to scare users into handing over their login details.
According to the email authentication experts at EasyDMARC, these scam emails manage to sidestep Google's DomainKeys Identified Mail (DKIM) checks. How? By cleverly using Google's own tools. The scammers name their fake app with the entire email text, which Google then automatically sends out from its system, making it appear legitimate.
Ross Richendrfer, a spokesperson for Gmail Security Communications, shared Google's response: “We’re aware of this class of targeted attack from this threat actor, and have rolled out protections to shut down this avenue for abuse. In the meantime, we encourage users to adopt two-factor authentication and passkeys, which provide strong protection against these kinds of phishing campaigns.”
Related
- Passkeys: all the news and updates around passwordless sign-ins
Related
- YouTube warns creators an AI-generated video of its CEO is being used for phishing scams
- Now Gmail has blue verified checkmark icons too
When these scam emails are forwarded to a user's Gmail, they stay signed and seem valid because DKIM only verifies the original message and headers. This same DKIM relay trick was used last month to target PayPal users. The phishing email directs victims to a seemingly official support page on sites.google.com, rather than the genuine accounts.google.com, banking on the user not noticing the difference.
Nick Johnson, a developer at Ethereum Name Service, fell victim to this Google phishing scam. He reported it as a misuse of Google OAuth applications, initially dismissed by Google as "working as intended." However, after reconsideration, Google is now addressing the issue.
Update, April 21st: Added statement from Google.
Related article
Microsoft, Azure and AI Tech Combat California Wildfire Risks
Microsoft invests in AI-driven wildfire detection, with Juan Lavista Ferres, CVP and Chief Data Scientist, discussing strategies to mitigate environmental damage.According to NASA, climate change impacts everyone on Earth, manifesting as rising tempe
Microsoft CEO Slams AI Labs Over Distillation
Satya Nadella, Microsoft’s CEO, calls out AI labs for hypocrisy regarding distillation criticism, a remark widely interpreted as targeting Anthropic. Credit: Getty ImagesMicrosoft CEO Satya Nadella challenges AI developers for limiting model distilla
Google rolls out fake call detection to protect against AI deepfake impersonation scams
Google announced on Tuesday that Android is launching fake call detection to protect against AI deepfake impersonation scams. The feature is rolling out globally in Phone by Google to Android 12+ devices this month, starting with Pixel devices.As peo
Related Special Topic Recommendations
Comments (2)
0/500
Just got one of those emails yesterday! They really amp up the urgency—'subpoena' sounds so official. Smarter phishing now exploits our trust in big names like Google, even using their own tools. That’s pretty cheeky. Stay vigilant, folks! 👁️

Phishing scammers are now posing as Google, sending out urgent emails from what looks like "[email protected]," claiming there's a subpoena from "law enforcement" about the recipient's Google Account. *Bleeping Computer* reveals that these fraudsters are using Google's "Sites" platform to craft convincing phishing emails and websites, designed to scare users into handing over their login details.
According to the email authentication experts at EasyDMARC, these scam emails manage to sidestep Google's DomainKeys Identified Mail (DKIM) checks. How? By cleverly using Google's own tools. The scammers name their fake app with the entire email text, which Google then automatically sends out from its system, making it appear legitimate.
Ross Richendrfer, a spokesperson for Gmail Security Communications, shared Google's response: “We’re aware of this class of targeted attack from this threat actor, and have rolled out protections to shut down this avenue for abuse. In the meantime, we encourage users to adopt two-factor authentication and passkeys, which provide strong protection against these kinds of phishing campaigns.”
Related
- Passkeys: all the news and updates around passwordless sign-ins
Related
- YouTube warns creators an AI-generated video of its CEO is being used for phishing scams
- Now Gmail has blue verified checkmark icons too
When these scam emails are forwarded to a user's Gmail, they stay signed and seem valid because DKIM only verifies the original message and headers. This same DKIM relay trick was used last month to target PayPal users. The phishing email directs victims to a seemingly official support page on sites.google.com, rather than the genuine accounts.google.com, banking on the user not noticing the difference.
Nick Johnson, a developer at Ethereum Name Service, fell victim to this Google phishing scam. He reported it as a misuse of Google OAuth applications, initially dismissed by Google as "working as intended." However, after reconsideration, Google is now addressing the issue.
Update, April 21st: Added statement from Google.
Microsoft, Azure and AI Tech Combat California Wildfire Risks
Microsoft invests in AI-driven wildfire detection, with Juan Lavista Ferres, CVP and Chief Data Scientist, discussing strategies to mitigate environmental damage.According to NASA, climate change impacts everyone on Earth, manifesting as rising tempe
Microsoft CEO Slams AI Labs Over Distillation
Satya Nadella, Microsoft’s CEO, calls out AI labs for hypocrisy regarding distillation criticism, a remark widely interpreted as targeting Anthropic. Credit: Getty ImagesMicrosoft CEO Satya Nadella challenges AI developers for limiting model distilla
Google rolls out fake call detection to protect against AI deepfake impersonation scams
Google announced on Tuesday that Android is launching fake call detection to protect against AI deepfake impersonation scams. The feature is rolling out globally in Phone by Google to Android 12+ devices this month, starting with Pixel devices.As peo
Just got one of those emails yesterday! They really amp up the urgency—'subpoena' sounds so official. Smarter phishing now exploits our trust in big names like Google, even using their own tools. That’s pretty cheeky. Stay vigilant, folks! 👁️





Home






