đ¨BOLOđ¨: All Gmail Users at Risk: Sophisticated Replay Attack Exploits Google Infrastructure, Posing Major Threat to Legal Professionals!
/
Protect your law firm's Gmail accounts from phishing and cyberattacks.
Gmail users, especially those in the legal field, face a new, highly sophisticated phishing campaign that leverages Googleâs own infrastructure to convincingly impersonate official communications and steal sensitive credentials. According to Pieter Arntz of Malewarebytes, this replay attack, first identified by Nick Johnson, lead developer of the Ethereum Name Service, demonstrates how attackers can bypass traditional security filters and trick even experienced professionals into compromising their Google accounts.
The attack begins with a realistic security alert, allegedly from Google, referencing a subpoena for account information. The email contains a link to a page hosted on sites.google.com, which is a legitimate Google domain but can be created by anyone with a Google account. The page is a near-perfect replica of the official Google support portal. Unsuspecting recipients who click âUpload additional documentsâ or âView caseâ are redirected to a fake Google sign-in page designed to harvest their credentials
What makes this campaign particularly dangerous is its use of DKIM (DomainKeys Identified Mail), an email authentication protocol. Attackers exploit DKIM by forwarding legitimate, DKIM-signed security alerts that embed the phishing message within the OAuth app name. Because the email body remains unchanged, the DKIM signature stays valid-even when replayed-allowing these phishing emails to pass through most security filters and appear authentic to recipients.
Legal professionals are prime targets because a compromised Google account can expose Gmail, Drive, Calendar, Contacts, and even third-party services accessed via Google authentication. The consequences can include identity theft, unauthorized access to confidential client information, and reputational harm.
Key Red Flags for Legal Practitioners:
Gmail phishing warning: Legal professional safeguard YOUR CLIENTâS sensitive case files online!
Official Google support or sign-in pages should be hosted on support.google.com or accounts.google.com, not sites.google.com.
Examine email headers carefully; a mismatch between the sender and the signed domain is suspicious.
Never click links in unsolicited emails or provide credentials on unfamiliar pages.
Avoid using Google or Facebook accounts to log in to other services; create dedicated accounts for each service.
The attack is repeatable and difficult to mitigate, as malicious pages on sites.google.com are hard to report and remove quickly. Google initially dismissed the issue as âWorking as Intended,â but after review, it has committed to addressing the OAuth bug.
Action Steps:
Educate your staff about this specific phishing method.
Implement multi-factor authentication (MFA) on all Google accounts.
Regularly audit account activity and access permissions.
Report suspicious emails and phishing attempts to your IT or security team immediately.
Staying vigilant and following these best practices can help protect your firmâs sensitive data and maintain client trust in an evolving threat landscape.
