New Google email scams are alarmingly convincing – how to spot them
Kerry Wan/ZDNETA sophisticated phishing scam has been taking advantage of Google security flaws to convince people that the malicious emails and websites are legitimate.In a series of X posts spotted by Android Authority, developer Nick Johnson explained how he was targeted by a phishing attack that exploits flaws in Google’s own infrastructure. In his first post, Johnson includes a screenshot of the scam email claiming that Google had been served a subpoena requiring it to produce a copy of his Google account data.Also: Clicked on a phishing link? 7 steps to take immediately to protect your accountsThe text of the email reads correctly; that is, it uses the right terms and doesn’t contain any typos or broken English. The message itself is considered valid and signed by Google. It’s sent from no-reply@google.com, a legitimate, automated company-used address. The email itself passes the DKIM signature check, which aims to verify the authenticity of a message. No other warnings appear, so this looks completely legitimate.Clicking a Sites link in the email takes you to a support portal that looks like an actual Google page. The page is even hosted on Google Sites, a platform where people can create and run their own websites. Using such a platform adds legitimacy to the scam as people assume it’s the real deal. More
