This Insane Google Email Scam Might Have Tricked Me
A sophisticated phishing scam exploits Google's email system and DKIM Replay to send seemingly legitimate emails from Google, tricking users into providing sensitive information through a fake login page hosted on sites.google.com.
MAIN POINTS FROM TRANSCRIPT
- Scammers used Google's own email system to send phishing emails from "[email protected]."
- The scam email claims a subpoena requires Google to produce account content, linking to a fake support case.
- The phishing site mimics Google's style and prompts users for login details on a fake Google login page.
- Scammers used DKIM Replay and sites.google.com to bypass email verification checks and host the scam site.
TAKEAWAYS
- Phishing scams can exploit legitimate systems, making detection difficult without careful scrutiny.
- Always verify email authenticity by checking headers and being cautious with unexpected requests.
- Be aware that sites.google.com can host user-generated content, not just official Google pages.
- Google is working on a fix, but similar techniques may be used in future scams.