That Google email look real? Don't click - it might be scam. Here's how to tell

Aitor Diago/Getty Images

A blase phishing scam is taking vantage of Google information flaws to person radical that the malicious emails and website are legitimate.

In a bid of X posts spotted by Android Authority, developer Nick Johnson explained however helium was targeted by a phishing attack that exploits flaws successful Google's ain infrastructure. In his archetypal post, Johnson includes a screenshot of the scam email claiming that Google had been served a subpoena requiring it to nutrient a transcript of his Google relationship data.

Also: Clicked connected a phishing link? 7 steps to instrumentality instantly to support your accounts

The substance of the email reads correctly; that is, it uses the close presumption and doesn't incorporate immoderate typos oregon breached English. The connection itself is considered valid and signed by Google. It's sent from no-reply@google.com, a legitimate, automated company-used address. The email itself passes the DKIM signature check, which aims to verify the authenticity of a message. No different warnings appear, truthful this looks wholly legitimate.

Clicking a Sites nexus successful the email takes you to a enactment portal that looks similar an existent Google page. The leafage is adjacent hosted connected Google Sites, a level wherever radical tin make and tally their ain websites. Using specified a level adds legitimacy to the scam arsenic radical presume it's the existent deal.

Clicking a nexus to "Upload further documents" oregon "View case" takes you to a sign-in screen, which besides looks similar it comes from Google. At this point, determination is 1 tip-off that this could beryllium a scam. As Johnson notes, the sign-in surface is hosted connected Google Sites alternatively of a Google relationship page, wherever you usually log in.

That's erstwhile Johnson ended the process. Had helium entered his username and password, his presumption is that the attackers would person stolen his login credentials and utilized them to compromise his Google account.

"This caller phishing onslaught exploits morganatic Google features to nonstop crafted emails that bypass immoderate accepted checks, arsenic good arsenic leverage Google Sites to big spoofed pages and harvest credentials," said Melissa Bischoping, caput of information probe astatine cybersecurity steadfast Tanium. 

"The email leveraged an OAuth exertion combined with a originative DKIM workaround to bypass the types of safeguards meant to support against this nonstop benignant of phishing attempt," explained Bischoping. "What makes this maneuver peculiarly unsafe isn't conscionable the method sleight of hand, but the deliberate usage of trusted services to gaffe past some users and detection tools."

The blasted for this scam should evidently beryllium aimed squarely astatine the scammers themselves. But Google is besides connected the hook, arsenic this exploit is imaginable owed to a mates of information vulnerabilities.

Also: The champion VPN extensions for Chrome: Expert tested and reviewed

First, Google Sites is simply a bequest merchandise that inactive allows for arbitrary scripts and embeds, according to Johnson. This weakness could let an attacker to adhd arbitrary and malicious codification and embedded objects to a web page. Second, person inspection of the email reveals that it came not from Google but from a privateemail.com address. That raises the question of however and wherefore Google signed it successful the archetypal place.

After receiving the scam email, Johnson said helium contacted Google to alert them to the vulnerabilities. Initially, the institution seemingly brushed speech his concerns, claiming that each of this was intended behavior. But past Google reversed its stance and has since indicated that it volition hole these bugs.

"More menace actors are deliberately choosing to leverage services that person precise morganatic concern usage cases, underscoring the inclination that, arsenic detection tools get stronger, adversaries are looking for ways to evade detection altogether, not needfully outsmart them with costly exploits," Bischoping said. "They're focusing connected the tools, sites, and functions organizations usage successful their regular work. By blending successful with mean traffic, and the likelihood that a emblematic recipient won't look that intimately astatine a trusted domain similar 'google.com,' menace actors person a precocious complaint of occurrence without important investment."

Thanks spell to Johnson for not lone catching this scam and informing radical but for pressing Google to resoluteness the issue. Until a hole is rolled out, however, however tin you support yourself against specified blase phishing attacks?

Also: Data-stealing cyberattacks are surging - 7 ways to support yourself and your business

Thomas Richards, infrastructure information signifier manager astatine information supplier Black Duck, offers the pursuing recommendations.

1. Beware of immoderate email that urges contiguous enactment and tells you you mightiness look antagonistic consequences. This is typically a motion that the email is malicious.
2. Check the "from" and " to" email addresses. If the " from" domain isn't the existent institution oregon the "to" recipient is not you, the email is apt a scam.
3. Avoid clicking connected links successful the email. In the onslaught described by Johnson, the malicious tract is hosted connected a Google domain. However, Google would ne'er nonstop you a ineligible ailment and past nonstop you to the Google Sites domain. If you're successful doubt, log into your Google relationship separately without clicking connected immoderate nexus and spot if immoderate messages oregon alerts are waiting for you.
4. Finally, tally an online hunt for the contented of the email. That tin archer you if others person reported it arsenic a scam oregon received a akin email.

Stay up of information quality with Tech Today, delivered to your inbox each morning.