The attack utilizes official Google infrastructure, including the company’s OAuth system and sites.google.com domain, to create messages that appear to come directly from Google’s trusted [email protected] address. A sophisticated phishing campaign has emerged targeting Google users with fraudulent law enforcement data requests, exploiting legitimate Google services to bypass security systems and create highly convincing scams. The deceptive campaign begins with victims receiving an alarming email claiming that Google has received a subpoena from law enforcement agencies demanding access to their Google account content. Upon authentication, they are redirected to a fraudulent support page hosted on sites.google.com-a legitimate Google domain that hosts user-created content. What makes this attack particularly insidious is that the emails genuinely originate from Google’s systems and are digitally signed by accounts.google.com, making them extremely difficult to distinguish from authentic communications. When registering a web application in the Google OAuth system, attackers exploit the “App Name” field, which allows arbitrary text input. After configuration, Google’s systems automatically send a security alert containing this injected text from the legitimate [email protected] address to the attacker’s registered email. The process begins with attackers registering a domain that mimics Google’s naming convention (for example, “googl-mail-smtp-out-198-142-125-38-prod.net”), then creating a free email address on this domain. The attackers then use email forwarding services to redistribute this authenticated Google message to multiple victims. When users follow the included links, they are directed to legitimate Google authentication pages if not already signed in, further building trust in the process. The message includes official-looking elements such as support ticket references, account IDs, and links to what appear to be Google support pages. “This attack demonstrates remarkable sophistication in abusing trusted systems,” explained Alanna Titterington, a security researcher who documented the campaign. Google has acknowledged the vulnerability after Kaspersky’s report and is working on remediation measures for its OAuth system. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 15 May 2025 16:39:54 +0000