- Crooks abuses Google’s message system to bypass E -mail protection
- Through OAuth -Apps they are able to generate convincing phishing -e -emails
- The campaign also uses sites.google.com
Researchers have discovered a smart and detailed phishing scheme that abused Google’s services to trick people into giving away their credentials for the platform.
Lead Developer of Ethereum Name Service, Nick Johnson, recently received an email that appeared to have come from [email protected]. The e -mail said Law Enforcement Contained Google for content found in his Google account.
He said that the e email looked legitimate and that it was very difficult to see that it is actually false. He believes that smaller technical users can very easily fall for the trick.
DKIM signed
Apparently Crooks would first create a Google account for me@domain. Then they created a Google OAuth app and put the entire phishing message (about the false subpoena) in the Name field.
Then they gave access to the E -Mail address in Google Workspace.
Google then sent a message -e -mail to ME@Domain account, but when the phishing message was in the name field, it would cover the entire screen.
Rolling to the bottom of the E -Mail message would show clear signs that something was wrong as you could read at the bottom of accessing Me@domain -e -Mail address.
The last step is to forward the e -mail to the victim. “When Google generated the E email, it is signed with a valid DKIM key and passes all controls,” Johnson explained how E emails landed in people’s inbox and not in spam.
The attack is called a “DKIM Replay Phishing Attack” as it leans on the fact that DKIM only in Google’s systems controls the message and the headings, not the envelope. When Crooks first registered ME@the domain address, Google shows it as if it were delivered to their E -Mail address.
To hide their intentions further, the villains used sites.google.com to create legitimation harvesting-landing page. This is Google’s free web building platform and should always raise red flags when stained.
Via Bleeping computer
