Introduction: A Trust Betrayed
When we see “no-reply@google.com” in our inbox, we instinctively trust it. It’s Google, after all. But that trust is exactly what a newly uncovered phishing campaign has weaponized — turning Google’s own services into a delivery mechanism for deception. Using a potent mix of Google Sites, Google OAuth abuse, and DKIM signature replay, attackers have developed a technique that allows malicious emails to appear utterly authentic — even passing SPF, DKIM, and DMARC checks.
This isn’t phishing with crude spelling errors or shady links. This is phishing 2.0 — and it’s dangerously convincing.
The Attack Breakdown: How Hackers Spoofed Google Itself
This campaign begins with a chillingly realistic email from “no-reply@google.com.” The message claims to be a subpoena notification regarding a supposed legal case involving the recipient. The email urges the reader to click a link to view “evidence” or “documents” related to the subpoena.
But here’s where things turn dark: the link points to a page hosted on Google Sites. The design is convincing. The layout mimics official Google support interfaces. There are no glaring red flags — no misspellings, no strange formatting. It looks real.
On that page are action buttons such as “View Case” or “Upload Documents.” Clicking them takes the user to a fake Google Account login page, also hosted within the Google Sites environment. The form looks identical to the real Google login screen. But entering your credentials here doesn’t log you into anything — it simply sends your username and password straight into a hacker’s database.
The Masterstroke: DKIM Replay Abuse
While hosting phishing pages on legitimate domains is bad enough, the campaign’s true brilliance lies in its use of DKIM replay attacks — a technique that even seasoned security professionals may underestimate.
Here’s how it works:
- Attackers create a malicious Google OAuth app with a name field that contains the full text of the phishing email.
- When Google’s systems send an alert email to notify the account owner about the new OAuth app, the message includes the app name — effectively embedding the phishing content into a legitimate Google email.
- That email is cryptographically signed by Google’s own DKIM key, verifying it as authentic.
- The attackers then resend that email using a third-party mail server. Since the original DKIM signature is still valid, spam filters and security systems accept it without hesitation.
The result? An email that passes all verification checks and appears to be directly from Google — because, technically, it is. It’s just been repurposed and replayed for malicious intent.
Why This Works: Trust, Infrastructure, and Complexity
Most phishing emails are stopped at the gates because they come from suspicious domains, fail authentication checks, or contain glaring design flaws. This campaign sidesteps all of that by weaponizing:
- Google’s trusted domain (
sites.google.com) - Google’s DKIM-signed messages
- Legitimate email infrastructure
- OAuth’s automatic notification behavior
The fusion of these elements produces an attack that not only looks legitimate but also feels legitimate to the average user.
This isn’t a case of someone falling for a poorly written email. It’s an exploit that takes advantage of the very systems meant to keep us safe.
Google’s Response: Patching the Invisible Hole
Google has since responded to the campaign, taking down the abused OAuth applications and terminating access to the phishing Sites pages. The company reminded users that it will never request passwords, two-factor codes, or sensitive documents via unsolicited email.
In addition, Google has announced plans to limit the scope of email content that can be replayed via DKIM, and is reviewing how notification content is embedded within OAuth alerts to prevent similar abuse.
Still, the challenge remains. Google can’t simply shut down its own infrastructure — it must walk a fine line between openness for developers and security for users.
The Bigger Picture: What This Means for You
This campaign underscores a larger issue: phishing has evolved. It’s no longer about tricking people with typos and shady links — it’s about manipulating trust, infrastructure, and complexity.
Even emails that pass all verification protocols may no longer be safe.
What can individuals do?
- Never trust an email just because it “passes” DMARC, SPF, or DKIM.
- Be wary of any unexpected messages that prompt urgent action, especially those involving legal or financial matters.
- Avoid clicking links in unsolicited emails. If in doubt, go directly to the source by typing URLs manually.
- Enable two-factor authentication (2FA) or passkeys for all critical accounts.
- Inspect URLs carefully. Even if a site looks legitimate, make sure it’s the actual domain of the provider (e.g.,
accounts.google.com, notsites.google.com/fake-support).
For Organizations: The New Security Paradigm
Companies must now adjust their email and cybersecurity protocols to account for these advanced threats. Relying solely on traditional email filters or domain-based authentication is no longer enough.
Here are key organizational strategies:
- Implement behavioral analysis tools that monitor for unusual sign-in attempts or logins from new devices.
- Educate employees regularly on new phishing tactics and run simulated phishing exercises.
- Deploy email security gateways that can detect contextual clues — such as mismatched sender/recipient behavior or unusual OAuth requests.
- Review and restrict the use of Google Sites and other cloud services internally, especially if employees are unaware of the risks they pose when misused.
Conclusion: The Age of Perfect Phishing
This attack didn’t just spoof a brand — it weaponized the brand’s very infrastructure. By exploiting the same systems designed to ensure email authenticity, attackers delivered messages that were not only persuasive but virtually undetectable.
We are now entering an age of phishing where the lines between legitimate and malicious communication blur dangerously. If the Internet once taught us to look for broken English and sketchy domains, it must now teach us to look deeper — at context, behavior, and even the platforms we thought we could trust.
In this new world, security isn’t about perfection. It’s about constant vigilance.
