Overview

• A newly uncovered phishing campaign uses Google Sites subdomains and DKIM-signed emails to impersonate legitimate Google security alerts, bypassing Gmail's spam filters.
• Google has attributed the attack to the threat actor Rockfoils and is in the final stages of deploying protections to shut down this exploit.
• The phishing emails originate from [email protected], leading users to a fake Google support page designed to steal account credentials.
• High-profile individuals, including Ethereum developer Nick Johnson, have been targeted in this campaign, highlighting the sophistication and scope of the attack.
• Google is urging users to enable two-factor authentication and passkeys, which offer stronger protection against phishing attempts, while advising caution with unsolicited security alerts.