Google's email spoofed by cunning phisherfolk

Google's email spoofed by cunning phisherfolk

Infosec In Brief: PLUS: Malware developers adopt Node.js; US disinformation warriors disbanded; Gig worker accounts for sale; and more

Phishers abuse Google OAuth to spoof Google in DKIM replay attack

In a rather clever attack, hackers leveraged a weakness that allowed them to send a fake email that seemed delivered from Google's systems, passing all verifications but pointing to a fraudulent page that collected logins.

Google users currently need to be particularly careful. Criminals have developed a new trick that can even fool trained eyes.

A new phishing campaign has managed to circumvent Gmail's security, as messages appear to be official emails from Google. Victims can nevertheless regain control of their account if they act within seven days.

Attackers have spread phishing emails via a real Google sender address. Due to a trick, the fraud is difficult to detect. (Phishing, Google)

Legacy Google Service Abused in Phishing Attacks

A sophisticated phishing campaign abuses weakness in Google Sites to spoof Google no-reply addresses and bypass protections. The post Legacy Google Service Abused in Phishing Attacks appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original… Read more → The post Legacy Google Service Abused in Phishing Attacks appeared first on IT Security News.