When you purchase through links on our site, we may earn an affiliate commission.Heres how it works.
As noted by Johnson, it even appears as a legitimate security alert.
From here, scammers are likely to steal login credentials and take over a user’s account.
Screenshot of fake support page viaNick Johnson on X
How did scammers fake a real Google email?
So, how was this phishing email able to get signed off by Google and use its official email?
Another outlier is the email from the sender, which was signed by “accounts.google.com.”
The attackers then grant the OAuth app access to the Google account, which is signed by Google itself.
From there, the phishing message is forwarded to victims, tricking anyone into thinking it’sreallyfrom Google.
However, there are always methods to avoid malicious emails.
Another sign is spotting any misspellings of names in email addresses or website links.
However, something was slightly off seeing as the “mailed-by” field was forwarded by “privateemail.com.”
If an email seems suspicious, always look for inconsistencies.
