Beware, hackers can apparently now send phishing emails from “no-reply@google.com”

• Crooks are abusing Google's notification system to bypass email protection
• Through OAuth apps, they are able to generate convincing phishing emails
• The campaign also uses sites.google.com

Researchers have discovered a clever and elaborate phishing scheme that abused Google’s services to trick people into giving away their credentials for the platform.

Lead developer of the Ethereum Name Service, Nick Johnson, recently received an email that seemed to have come from no-reply@google.com. The email said that law enforcement subpoenaed Google for content found in his Google Account.

He said that the email looked legitimate, and that it was very difficult to spot that it’s actually fake. He believes less technical users might very easily fall for the trick.

DKIM signed

Apparently, the crooks would first create a Google account for me@domain. Then, they would create a Google OAuth app, and put the entire phishing message (about the fake subpoena) in the name field.

Then, they would grant themselves access to the email address in Google Workspace.

Google would then send a notification email to the me@domain account, but since the phishing message was in the name field, it would cover the entire screen.

Scrolling to the bottom of the email message would show clear signs that something was amiss, since at the bottom one could read about getting access to the me@domain email address.

The final step is to forward the email to the victim. “Since Google generated the email, it's signed with a valid DKIM key and passes all the checks,” Johnson explained how the emails landed in people’s inbox and not in spam.

The attack is called a “DKIM replay phishing attack,” since it leans on the fact that in Google’s systems, DKIM checks only the message and the headers, not the envelope. Since the crooks first registered the me@domain address, Google will show it as if it was delivered to their email address.

To hide their intentions even further, the crooks used sites.google.com to create the credential-harvesting landing page. This is Google’s free web-building platform and should always raise red flags when spotted.

Via BleepingComputer

You might also like

• Millions of airline customers possibly affected by OAuth security flaw
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers