Gmail threat report

Scammers are exploiting Google's legitimate security notification system to target Gmail users with fraudulent messages. Attackers inject malicious text into Google app password names, causing Google to generate authentic, digitally signed security alerts containing scam content—including fake invoices and fraudulent support numbers. This technique makes phishing emails appear to originate directly from Google's infrastructure, significantly increasing their credibility and success rate.

• Scammers Exploit Genuine Google Security Alerts to Target Gmail (opens in a new tab)