Here we go again. Google has confirmed another attack on Gmail users that combines inherent vulnerabilities in the platform with devious social engineering. The net result is a flurry of headlines and viral social media posts followed by an urgent platform update. Google’s security warning is clear. Users should stop using their passwords. This latest attack has been bubbling on X and in a number of crypto outlets given the victim was an Ethereum developer. Nick Johnson says he was “targeted by an extremely sophisticated phishing attack,” one which “exploits a vulnerability in Google’s infrastructure, and given their refusal to fix it, we’re likely to see it a lot more.” The attack started with an email from a legitimate Google address warning Johnson that it has been served with a subpoena for his Google account. “This is a valid, signed email,” Johnson says, “sent from This email address is being protected from spambots. You need JavaScript enabled to view it.. It passes the DKIM signature check, and Gmail displays it without any warnings - it even puts it in the same conversation as other, legitimate security alerts.” This is clever, and technically the attackers have exploited a way to send a correctly titled Google email to themselves from Google, which they can then forward to others with the same legitimate DKIM check even though it’s a copy of the original. But the objective is more simple. A credential phishing page that mimics the real thing. “We’re aware of this class of targeted attack,” Google has now confirmed in a statement, “and have been rolling out protections for the past week. These protections will soon be fully deployed, which will shut down this avenue for abuse. In the meantime, we encourage users to adopt two-factor authentication and passkeys, which provide strong protection against these kinds of phishing campaigns." That’s all that matters. Stop using your password to access your account, even if you have two-factor authentication (2FA) enabled and especially if that 2FA is SMS-based. It’s now too easy to trick you into giving up your login and password and then bypassing or stealing the SMS codes as they come into your device. There’s nothing to stop an attacker using your password and 2FA code on their own device. What does stop them is a passkey. This is linked to your own physical device and requires your device security to unlock your Google account. That means if an attacker does not have your device they can’t login. While Google has not yet gone as far as deleting passwords completely — which is Microsoft’s stated intention, you will know not to use your password to sign-in which will stop a malicious phishing page stealing it. The cleverness in this latest attack added to others we have seen in recent months is easily thwarted by updating your account security. These attacks are getting ever more sophisticated, and AI will enable this level of “targeting” to be done on a massive scale. As Microsoft warns, “AI has started to lower the technical bar for fraud and cybercrime actors looking for their own productivity tools, making it easier and cheaper to generate believable content for cyberattacks at an increasingly rapid rate. This latest Google scam, exploiting weaknesses in its core infrastructure to mask an attack, is now getting more media pick up (1,2). Unfortunately, most of this misses the point. Google has been very clear each time such stories make headlines, emphasizing two key points. First, that the company will never reach out proactively to users to warn them about a support or security issue or to recommend they take actions to stay safe. And second, enhancing account security per its advice will keep those accounts safe. ”Learn more by visiting OUR FORUM.

Spam and phishing emails are an annoying everyday occurrence that everyone is probably familiar with and finds annoying. These intrusive messages often clog up your inbox and require tedious deletion or filtering. Worse still, those who are act carelessly run the risk of falling victim to scammers. But, as strange as it may sound, spam emails can actually be useful to the potential victims scammers are targeting, which is why you shouldn’t delete them. All major mail providers are starting to rely on complex and adaptive spam filters that are getting better and better at distinguishing between wanted and unwanted e-mails. An important prerequisite for this learning effect: The software must be able to practice and this is exactly what spam mails are useful for. Instead of deleting spam mails, we recommend you proceed as follows: If you use an email client such as Outlook or Thunderbird: Manually mark relevant messages as spam (or as “junk”) if your email program hasn’t already done it itself. This will train the software’s spam filter and you will (hopefully) have to deal with annoying spam mails less and less in future because the automatic filter will improve. If you retrieve emails with a browser: Depending on which provider you use, you can mark the annoying messages as spam in different ways. Of course, you only need to make this effort if the junk emails are displayed as normal emails in your inbox and haven’t already ended up in the spam folder. You can mark such messages in the inbox (tick the box) and send them directly to the spam folder using the “Spam” or “Junk” command in the menu bar. This also works with individual (open) emails, where the path to the spam bin is sometimes via a “Move” button above the message text. Both privately and professionally, these procedures promise less rubbish mail in the long term. The senders of such messages are also blacklisted more quickly. If you use a shared mail server in the office, you may be doing your colleagues a great service by preventing them from having to deal with the same scam messages that you’ve already marked as spam and sorted out yourself. Many providers and email clients now offer an easy way to unsubscribe from unwanted advertising emails, newsletters, and the like with a quick click directly in your inbox. This function is useful if you do not want to delete yourself from mailing lists by hand or aren’t interested in the advertising it contains. However, the well-intentioned function also harbors a danger, at least in the case of fraudulent messages. This is because you inadvertently inform the sender that your own e-mail address actually exists and is actively managed. Spam crooks send millions of emails every day, sometimes indiscriminately to randomly generated recipient addresses. They are often unaware of whether the accounts they write to really exist or whether messages are read there–until users click on the unsubscribe button. The scammers then receive a request to stop writing to the email address in question, whereupon, of course, they do exactly the opposite. Spammers and scammers are becoming more and more sophisticated. Even experienced users can be taken in by the brazen crooks. If you want to protect yourself better, you can turn to professional software, it makes life difficult for the scoundrels on the net. Learn useful tips to protect yourself by visiting OUR FORUM.