Table of contents
- A phishing attack that speaks Google’s language
- The core of the scam: DKIM replay and fake Google domains
- Not just Google: the scam is spreading across platforms
- How to protect yourself from this new scam
- Security begins with awareness
A phishing attack that speaks Google’s language
A new cyber security threat is targeting unsuspecting users by exploiting a vulnerability in Google’s OAuth system, the protocol that lets users authorize third-party apps to access their data without sharing their password.
The danger? Seemingly legitimate emails, generated by malicious applications, manage to bypass standard security checks and trick users into giving access to personal information. The deception is so well crafted that even email systems recognize it as an authentic message.
The core of the scam: DKIM replay and fake Google domains
Hackers use a clever trick. They register a domain, create a fake OAuth app, and convince Google to generate a real security notification that’s sent to the victim from what appears to be no-reply@google.com.
Using a technique called DKIM replay, which manipulates email authentication protocols, the message appears digitally signed and trustworthy, slipping through phishing filters.
Meanwhile, fake phishing websites, hosted on domains that mimic Google’s, are near-perfect replicas of the real thing, fooling users into submitting login credentials.
Not just Google: the scam is spreading across platforms
This cyber threat isn’t limited to Google. Similar campaigns have been identified on PayPal and other platforms that use OAuth protocols.
The approach remains the same: a fake app gains permission to send alerts or access accounts, then redirects users to cloned websites to collect sensitive data.
How to protect yourself from this new scam
Until Google implements a structural fix, user awareness is the first line of defense. Here are the essential safety steps:
- Check your authorized apps regularly in your Google Account settings and revoke any suspicious ones.
- Don’t automatically trust emails that appear to be from Google, especially those making urgent requests.
- Hover over links before clicking, legitimate messages won’t send you to unfamiliar domains.
- If in doubt, search the message contents online, if it’s a scam, others likely reported it.
Security begins with awareness
This new wave of sophisticated attacks exploits the trust users place in well-known digital platforms. But no system is bulletproof, and cybercriminals are always looking for ways to break in.
Stay alert, verify everything, and remember: if something feels off, it probably is.
