Cybercriminals are exploiting Google’s infrastructure and DKIM protocols to launch highly convincing phishing attacks that bypass traditional email security filters. These advanced techniques are being used to trick users into giving up sensitive credentials—posing a major threat to organizations of all sizes.
🛑 What Happened: A New Level of Phishing Sophistication 🛑
In a newly discovered attack, threat actors used Google Sites and DKIM-signed emails to launch a phishing campaign that appears to come from a legitimate Google email address (no-reply@google.com).
“This is a valid, signed email – it really was sent from no-reply@google.com,” said Nick Johnson, lead developer at Ethereum Name Service (ENS).
These phishing emails pass all authentication checks, including DKIM, SPF, and DMARC, allowing them to slip past spam filters and land directly in a user’s inbox without warning signs.
How the Phishing Attack Works
The email pretends to be a legal subpoena notification from a law enforcement agency. It urges recipients to click on a Google Sites URL to view the case details or respond.
Once clicked, users are redirected to a fake Google Support page hosted on Google Sites—built to mimic Google’s official interface. From there, users are taken to a counterfeit Google login page, where entering credentials means handing them over to attackers.
Why It’s So Effective:
- Signed by Google: The email has a valid “Signed by” header from accounts.google.com.
- Bypasses Gmail filters: Gmail shows it as part of a legitimate email thread.
- Google Sites vulnerability: Attackers exploit the platform’s ability to run scripts and host dynamic content.
The DKIM Replay Exploit Explained
This phishing campaign uses a tactic called DKIM Replay:
- Attacker creates a Google account using their custom domain.
- They develop a Google OAuth app with the content of the phishing message in its name.
- They then trigger a Security Alert email from Google to themselves.
- Since the email is genuinely sent by Google, it’s signed with a valid DKIM key.
- They forward this signed email using a third-party mail service (like Jellyfish SMTP), preserving the DKIM signature.
- The email is finally delivered to the victim via Namecheap’s PrivateEmail infrastructure, passing all authentication checks.
“Because they named their Google account ‘me@…’, Gmail shows the message as being sent to ‘me’, making it even more deceptive,” said Johnson.
Why Your Business Should Be Concerned
This attack showcases how even advanced email security protocols can be exploited when threat actors get creative.
- Credential theft can lead to:
- Unauthorized account access
- Internal data breaches
- Compromised cloud platforms
- Your team may not recognize these attacks, especially if emails appear 100% legitimate.
What Google and Experts Are Saying
Google has since patched this attack vector. However, a spokesperson emphasized:
“We never request passwords or OTPs via email. Always use 2FA and passkeys to protect your Google Account.”
Experts at EasyDMARC and Kaspersky have also flagged a sharp rise in SVG-based phishing attacks—where malicious JavaScript is embedded in image files to launch redirects to fake login pages.
“Over 4,100 SVG phishing emails were observed just this year,” Kaspersky reported.
🛡️ How to Protect Your Business
At CybrogenIT, we help businesses stay ahead of sophisticated phishing threats by providing:
- Advanced email filtering & spoof detection
- Real-time phishing simulation training
- Zero-trust authentication frameworks
- Endpoint monitoring and alert systems
🔍 Get a Free Phishing Risk Assessment
Think your inbox is secure? Think again. Schedule a free cybersecurity risk assessment with CybrogenIT today and stay one step ahead of the next attack.