The attack, which successfully bypasses Gmail’s security filters, appears legitimate to users as it originates from authentic Google domains and passes all standard security checks, including DKIM authentication. Nick Johnson, Ethereum Name Service (ENS) developer, reported being targeted by an attack that exploited a flaw in Google’s infrastructure, allowing threat actors to send emails that appear to come directly from Google’s official domains. Researchers noted that the embedded link in the email pointed to a phishing page under the ‘google.com’ subdomain, guiding users to enter a simulated login interface to steal credentials. In the meantime, security experts recommend users enable two-factor authentication, use passkeys where available, and remain vigilant about any emails requesting account verification or login credentials, even if they appear to come from legitimate sources. In Johnson’s case, the phishing email claimed that a subpoena had been served on Google LLC requiring the production of his Google Account content, complete with an official-looking case reference number. Unlike conventional phishing attempts that rely on fake login pages, this attack leverages legitimate OAuth authorization flows. Google has confirmed awareness of this phishing campaign and acknowledged that it exploits OAuth and DKIM mechanisms in a creative way. A highly sophisticated phishing attack exploiting vulnerabilities in Google’s OAuth system has been identified. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The message comes from “no-reply@google[.]com” and passes all standard security checks, including DKIM verification. “Recently I was targeted by an extremely sophisticated phishing attack, and I want to highlight it here. It exploits a vulnerability in Google’s infrastructure, and given their refusal to fix it, we’re likely to see it a lot more,” Johnson wrote on X. “Google has reconsidered and will be fixing the OAuth bug!” Johnson confirmed in a recent update.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 21 Apr 2025 06:20:24 +0000