Ethereum Founder Warns of Advanced Google Phishing Attack

The founder and lead developer of Ethereum Name Service (ENS), Nick Johnson, has issued a warning to his followers on X about an advanced phishing attack that mimics google to deceive users into divulging their login credentials. The attack leverages Google’s infrastructure to send a fake alert, claiming that the user's Google data is being shared with law enforcement due to a subpoena. This alert passes Google’s DKIM signature check and appears in the user’s inbox without any warnings, even in the same conversation as legitimate security alerts.

The fake subpoena appears to originate from a Google no-reply domain, adding to its legitimacy. Users are given the option to view case materials or protest by clicking a support page link, which is hosted on Google Sites. This tool allows anyone with a Google account to create a site that looks legitimate and is hosted under a trusted Google-owned domain. The scammers use the Google OAuth app, where they can input any desired name in the App Name field, and a domain via Namecheap to set the "From" address as no-reply@google and the reply address as anything they choose.

Johnson explained that the email is forwarded by a private email address, which is a telltale sign of a phishing scam. The scammers exploit Google systems by weaponizing Google Sites and the Google OAuth app to create a convincing phishing attack. The message passes signature validation and appears as a legitimate message in the user’s inbox, even in the same thread as legitimate security alerts.

In response to the phishing attack, a Google spokesperson stated that they are aware of the issue and are in the process of shutting down the mechanism that attackers are using to insert arbitrary text. This will prevent the method of attack from working in the future. The spokesperson also encouraged users to adopt two-factor authentication and passkeys, which provide strong protection against these kinds of phishing campaigns. Google will never ask for any private account credentials, including passwords, one-time passwords, or push notifications, nor will they call users.