Beware of this sneaky Google phishing scam

Attackers are sending phishing emails that look to beryllium from “[email protected],” presented arsenic an urgent subpoena alert astir “law enforcement” seeking accusation from the target’s Google Account. Bleeping Computer reports that the scam utilizes Google’s “Sites” web-building app to make realistic-looking phishing websites and emails that purpose to intimidate victims into giving up their credentials.

As explained by EasyDMARC, an email authentication company, the emails negociate to bypass the DomainKeys Identified Mail (DKIM) authentication that would usually emblem fake emails, due to the fact that they came from Google’s ain tool. The scammers simply entered the afloat substance of the email arsenic the sanction of their fake app, which autofills that substance into an email sent by Google to their ain chosen address.

When forwarded from the scammer to a user’s Gmail inbox, it remains signed and valid since DKIM lone checks the connection and headers. PayPal users were likewise targeted utilizing the DKIM relay onslaught past month. Finally, it links to a real-looking enactment portal connected sites.google.com alternatively of accounts.google.com, hoping the recipient won’t drawback on. 

Etherem Name Service developer Nick Johnson received the aforesaid Google phishing scam and reported the attackers’ misuse of Google OAuth applications arsenic a information bug to Google. The institution initially brushed it disconnected arsenic “working arsenic intended,” but past backtracked and is present moving connected a fix.