{"id":16393,"date":"2025-04-24T04:47:32","date_gmt":"2025-04-24T04:47:32","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/dev-claims-google-exploit-in-email\/"},"modified":"2025-04-24T04:47:32","modified_gmt":"2025-04-24T04:47:32","slug":"dev-claims-google-exploit-in-email","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/dev-claims-google-exploit-in-email\/","title":{"rendered":"Dev claims Google exploit in email"},"content":{"rendered":"\n<\/p>\n
\n

<\/p>\n

<\/p>\n

A sophisticated phishing campaign has been uncovered, in which hackers have successfully exploited Google<\/a>\u2019s infrastructure to send deceptive emails that appear to originate from a legitimate Google address, tricking users into revealing their login credentials. Recently, Nick Johnson, the lead developer of the Ethereum Name Service (ENS), exposed the attack, which involved emails sent from no-reply@google.com that passed DomainKeys Identified Mail (DKIM) authentication, thereby deceiving Gmail into treating them as genuine security alerts.<\/p>\n

According to Johnson, who shared his findings on X (formerly Twitter), \u201cThese emails are valid, signed, and display no warnings in Gmail. They appear in the same thread as real Google security alerts, making them even more convincing.\u201d<\/p>\n

The emails claim to notify recipients of a subpoena related to unspecified content from their Google Account and prompt users to click a sites.google.com link to \u201cexamine the case materials\u201d or \u201csubmit a protest.\u201d This link redirects to a counterfeit Google Support page hosted on Google Sites, where users are asked to either \u201cupload additional documents\u201d or \u201cview [the] case.\u201d These buttons then redirect to a near-perfect replica of the Google Account sign-in page, designed to harvest user credentials.<\/p>\n

Johnson noted that the only indication that it\u2019s a phishing attack is that it\u2019s hosted on ‘sites.google.com’ instead of ‘accounts.google.com’.<\/p>\n

Johnson warned that the realistic design and subtle domain differences make the phishing attempt particularly dangerous. \u201cThese scams are designed to look as real as possible,\u201d he said. \u201cUsers who don\u2019t spot the slightly altered domain could risk identity theft or financial loss.\u201d<\/p>\n

Google’s response to hackers ‘misusing’ its infrastructure<\/h2>\n

Google confirmed the attack and stated that it has since closed the loophole that allowed the abuse. According to a Google spokesperson, \u201cWe\u2019re aware of this class of targeted attack from this threat actor and have rolled out protections to shut down this avenue for abuse. We encourage users to adopt two-factor authentication and passkeys for stronger protection.\u201d The company reiterated that it never asks for account credentials — including passwords, one-time codes (OTPs), or confirmation prompts — via email or phone. Google also advised users to verify the authenticity of any email by opening links manually in a separate browser window. As per Google\u2019s privacy policy, legitimate government requests for account information are accompanied by advance notice\u2014unless legally prohibited.<\/p>\n

Cybersecurity experts’ safety tips for Gmail users<\/h2>\n

Cybersecurity experts caution that Gmail users, particularly those not using two-factor authentication or passkeys, are at heightened risk. While passwords alone can be compromised, passkeys\u2014hardware-bound login credentials\u2014offer significantly stronger resistance to phishing.<\/p>\n

To avoid falling victim, users should be skeptical of emails that use vague greetings, urgent calls to action, or links requesting personal data. <\/p>\n

\n