ENS founder warns of Google spoof that tricks users with a fake subpoena

The laminitis and pb developer of Ethereum Name Service has warned his X followers of an “extremely sophisticated” phishing onslaught that tin impersonate Google and instrumentality users into giving retired login credentials. 

The phishing onslaught exploits Google’s infrastructure to nonstop a fake alert to users informing them that their Google information is being shared with instrumentality enforcement owed to a subpoena, ENS’ Nick Johnson said successful an April 16 station to X. 

“It passes the DKIM signature check, and GMail displays it without immoderate warnings - it adjacent puts it successful the aforesaid speech arsenic other, morganatic information alerts,” helium said. 

The fake subpoena appears to beryllium from a Google no-reply domain. Source: Nick Johnson

As part of the attack, users are offered the accidental to presumption the lawsuit materials oregon protestation by clicking a enactment leafage link, which uses Google Sites, a instrumentality that tin beryllium utilized to physique a website connected a Google subdomain, according to Johnson. 

“From there, presumably, they harvest your login credentials and usage them to compromise your account; I haven’t gone further to check,” helium said.

The Google domain sanction gives the content it’s legit, but Johnson says determination are inactive telltale signs it’s a phishing scam, specified arsenic the email being forwarded by a backstage email address. 

Scammers exploit Google systems 

In an April 11 report, bundle steadfast EasyDMARC explained that the phishing scam works by weaponizing Google Sites.

Anyone with a Google relationship tin make a tract that looks morganatic and is hosted nether a trusted Google-owned domain.

They besides usage the Google OAuth app, wherever the “key instrumentality is that you tin enactment thing you privation successful the App Name tract successful Google,” and usage a domain via Namecheap that allows them to “put no-reply@google relationship arsenic From code and the reply code tin beryllium anything.”

Source: Nick Johnson

“Finally, they guardant the connection to their victims. Because DKIM lone verifies the connection and its headers and not the envelope, the connection passes signature validation and shows up arsenic a morganatic connection successful the user’s inbox — adjacent successful the aforesaid thread arsenic legit information alerts,” Johnson said. 

Google deploying countermeasures soon 

Speaking to Cointelegraph, a Google spokesperson said they are alert of the contented and are shutting down the mechanics that attackers are utilizing to insert the “arbitrary magnitude text,” which volition forestall the method of onslaught from moving successful the future. 

Related: Hackers fell crypto address-swapping malware successful Microsoft Office add-in bundles

“We’re alert of this people of targeted onslaught from the menace actor, Rockfoils, and person been rolling retired protections for the past week. These protections volition soon beryllium afloat deployed, which volition unopen down this avenue for abuse,” the spokesperson said. 

“In the meantime, we promote users to follow two-factor authentication and passkeys, which supply beardown extortion against these kinds of phishing campaigns.” 

The spokesperson added that Google volition ne'er inquire for immoderate backstage relationship credentials — including passwords, one-time passwords oregon propulsion notifications, nor telephone users.  

Magazine: Your AI ‘digital twin’ tin instrumentality meetings and comfortableness your loved ones