Hackers Exploit Google OAuth to Send Verified Phishing Emails

In a sophisticated phishing campaign (using google Oauth), hackers have discovered a way to send fake emails that appear to come from Google itself. These messages pass standard email security checks such as DomainKeys Identified Mail (DKIM), making them look highly convincing—even to tech-savvy users.

How the Phishing Attack Works

The attackers exploited a flaw in Google’s DKIM system, using Google’s own infrastructure to send emails that looked authentic. One such email appeared to come from no-reply@google.com, a trusted Google email address. The message passed all verification checks and was even grouped with other legitimate security alerts from Google, increasing the chances of users falling for the scam.

The email redirected users to a fake Google support portal, asking them to log in with their Google account credentials. Although the portal was hosted on sites.google.com, which is a legitimate Google-owned domain, it was not the official login site, accounts.google.com. This subtle difference was the only clue that the email was part of a phishing scam.

Real Case: Targeting Ethereum Developer

The phishing attempt was discovered by Nick Johnson, a developer of the Ethereum Name Service (ENS). He received a fake security alert claiming there was a subpoena requesting access to his Google account data. The message was structured so well that even Google’s email system placed it with legitimate alerts in his inbox.

What raised Johnson’s suspicion was the URL of the support portal. Although it looked identical to the real one, it was hosted on sites.google.com, not the typical Google login page. “The only hint it’s a phish is that it’s hosted on sites.google.com instead of accounts.google.com,” Johnson noted.

DKIM Replay Attack: The Clever Trick

The attackers used a method called a DKIM replay phishing attack. Here’s how it worked:

1. The attacker first created a new domain and a Gmail account with a name like me@domain.com. The “me” username tricks Gmail into displaying the message as if it’s addressed to the user.

2. They then created a Google OAuth app with the phishing message embedded in its name. They added lots of white space to hide the Google-generated warning about app permissions.

3. Next, they granted their OAuth app access to the email address associated with the app. When this happens, Google automatically sends a security alert email, confirming that a new app has been granted access.

4. Since the email was generated by Google, it is DKIM-signed and passes all security checks.

5. The attacker then forwarded this legitimate-looking alert to victims, making it seem like Google itself sent the email.

Because DKIM verification only checks the message body and headers—but not the envelope or true sender—the spoofed email passed all validation checks. This makes it appear completely legitimate to the recipient.