In what has been described as an “extraordinarily refined phishing assault,” risk actors have leveraged an unusual strategy that allowed bogus emails to be despatched by way of Google’s infrastructure and redirect message recipients to fraudulent websites that harvest their credentials.
“The very first thing to notice is that it is a legitimate, signed electronic mail – it actually was despatched from no-reply@google.com,” Nick Johnson
Phishers Exploit Google Websites and DKIM Replay to Ship Signed Emails, Steal Credentials
