Seth Kravitz

Just got a phishing email that Gmail authenticated as Google. DKIM/DMARC passed. I can see a lot of people falling for this one, since it plays to the idea that your account has already been compromised. Scammer puts the scam in an app-password name, triggers a real Google alert, then forwards the alert email to your email address. How this attack works, and why it’s convincing: 1. The trick: The attacker puts the threatening text and shortened URL into an app password’s customizable name on another account. Google incorporates that text into a real security notification and signs the email. 2. The delivery: That notification is forwarded through another mailbox to the victim. In this message, Gmail still recorded passing Google DKIM and DMARC authentication. 3. What makes it convincing: The Google sender, signature, branding, and “Check activity” button are legitimate. The suspected attacker-supplied text appears inside the same trusted-looking template, using a deadline to push you toward its separate link. 4. The giveaway: Both the notification and its genuine Google button refer to someone else’s account. The “permanent access after 24 hours” claim is false; app passwords can be revoked. Be careful out there folks!