That Google email look real? Don’t click – it might be scam. Here’s how to tell – ZDNet

🔍 Summary:

A recent phishing scam has been exploiting Google’s security vulnerabilities to deceive users into believing malicious emails and websites are legitimate. Developer Nick Johnson, who was targeted by this scam, detailed his experience in a series of posts reviewed by Android Authority. The scam email, appearing to be from Google, claimed that the company was required to share Johnson’s account data due to a subpoena. Despite being well-crafted without any obvious errors and passing email authenticity checks, the email was actually from a deceptive source.

The phishing attempt continued as Johnson clicked on a link in the email, which led him to a Google Sites-hosted page mimicking a genuine Google support portal. Further links prompted him to a login page that also appeared legitimate but was hosted on Google Sites, a key indicator of the scam. Johnson stopped before entering his credentials, which would have given the attackers access to his Google account.

Security expert Melissa Bischoping from Tanium highlighted that the scam cleverly bypassed traditional security checks by using legitimate Google features and an OAuth application combined with a DKIM workaround. This approach not only exploited technical vulnerabilities but also used trusted services to evade detection tools.

The scam’s effectiveness is partly due to Google Sites allowing arbitrary scripts, a legacy issue that Google initially dismissed but later acknowledged and promised to fix. The incident underscores a growing trend where attackers exploit legitimate business tools to blend in with normal traffic, making detection more challenging.

Security professionals, including Thomas Richards from Black Duck, emphasize the importance of staying informed about security threats and recommend vigilance in verifying the authenticity of emails and websites, especially those linked to critical account information.

📌 Source: https://www.zdnet.com/article/that-google-email-look-real-dont-click-it-might-be-scam-heres-how-to-tell/