Gmail users have been targeted by a wave of phishing attacks, according to Google, which owns the service.
The tech giant issued the warning weeks after confirming a “sophisticated attack” affecting its 1.8 billion Gmail users.
The scam was first reported by Nick Johnson, an Ethereum developer, who shared a screenshot of a fraudulent email posing as a Google legal notice.
“The email appeared to come from a legitimate Google address, claiming I had been served a subpoena,” Johnson said.
Clicking the fraudulent link led him to a fake support portal designed to steal login credentials.
Google later shut down the mechanism that enabled the attack, adding new security measures.
How Hackers Exploit Gmail Accounts
The phishing email passed Gmail’s security checks, including DKIM signature verification, making it appear legitimate.
“It even showed up in the same conversation as real security alerts,” Johnson noted.
Hackers used Google Sites to craft the fake page because people trust the google.com domain.
Without extra security measures like passkeys and two-factor authentication (2FA), scammers can easily access an account with stolen login details.
Protect Yourself from Phishing Scams
Google advises users to activate 2FA and passkeys for stronger security.
“Google will never ask for account credentials, passwords, or push notifications—and we will never call you,” the company stated.
Phishing scams often use generic greetings, urgent requests, and suspicious links to deceive users.
However, Google says account recovery is possible even after falling victim to these scams.
The tech giant reassures users that locked accounts can still be recovered within a week—provided they have a recovery phone number or email set up.
To stay safe, avoid clicking unknown links and verify sender details before responding.
Rate, Like 👍, Comment, share this article and Follow us on our social media handles.
WhatsApp Channel
Telegram Channel
