The New Scam Everyone Is Falling For

Inboxes can feel like digital warzones these days. Most of us know not to click on suspicious links or give out passwords, but what if the scam isn’t suspicious at all? What if the email comes from a legitimate Google^® address and passes all standard security checks? That’s exactly what’s happening in a new wave of Gmail scams targeting users in one of the most deceptive cyberattacks seen to date.

How the Scam Works

Cybercriminals are now leveraging a tactic known as a “replay attack,” but this version is unusually advanced. According to security experts at Malwarebytes, the fraud starts with an email that looks like it’s from Google, as reported by LADbible.

The email appears to be a legitimate notification from no-reply@google.com - a real, verified domain - which means it passes Gmail’s DKIM signature verification. Translation: Gmail’s filters think it’s clean. So, it lands directly in your inbox.

Once opened, the email directs users to what seems like a genuine Google support page. The links say things like “View case” or “Upload documents,” and they lead to an eerily convincing Google sign-in screen. This is where the real trap lies. Enter your credentials, and the attackers harvest your data - and possibly your entire account.

What makes this particular scam more dangerous is its ability to blend in seamlessly with legitimate Gmail conversations, especially those involving security alerts. In some cases, users have reported phishing emails appearing within the same thread as genuine Google messages.

Who Is at Risk?

With over 1.8 billion Gmail users worldwide, the answer is simple - everyone. But users who rely heavily on Gmail for personal or professional communication, especially those who manage multiple accounts, sign in on shared devices, or use Gmail to log into third-party services, are at higher risk.

Non-Gmail users aren’t immune either. As Google expands its end-to-end encryption rollout for businesses, even those on other platforms may receive fake invitations asking them to view encrypted emails via a Google Workspace guest account. These unfamiliar workflows create more opportunities for attackers to insert lookalike links and steal login details.

What Makes This Attack So Effective?

This isn’t your typical “Nigerian prince” scam. The attackers are taking advantage of a trust flaw, exploiting the legitimacy of Google’s own infrastructure. According to experts like Nick Johnson, who first flagged the attack publicly, even seasoned tech professionals are struggling to identify these fakes.

In one alarming version of the scam, victims receive what looks like a subpoena notice from Google, claiming a legal investigation requires access to their account. Clicking to view the document reroutes users to a fraudulent login page that mimics Google’s support portal, complete with branding and interface familiarity.

How to Protect Yourself

If you use Gmail, now is the time to level up your awareness. Here’s what experts recommend:

• Don’t click unsolicited links: Even if the email looks legit, never click without verifying.
• Check the domain carefully: Official Google sign-in pages use accounts.google.com. Scammers often use sites.google.com, which anyone can register for.
• Review the email headers: They can offer clues about inconsistencies in the sender path.
• Avoid using Gmail to log into third-party sites: Create separate logins whenever possible.
• Enable two-factor authentication (2FA): It won’t stop every scam, but it adds a layer of protection.
• Use a password manager: These tools can alert you if a site doesn’t match the legitimate login page.

Google has confirmed that it is rolling out enhanced protections to address these threats and is closely monitoring abuse of its domains. Still, no system is foolproof - especially when attackers weaponize trust.

Stay Skeptical, Stay Safe

These days, it’s not just about spotting bad grammar or pixelated logos. The line between real and fake has never been thinner, and even savvy users are at risk. So, the next time you get an email from Google, pause. Examine. Question. Because in 2025, it’s not paranoia. It’s just good practice.

References: Everyone with a Gmail account is warned they’re ‘at risk’ as new ‘extremely sophisticated’ scam emerges | New Gmail Feature Leaves Millions Of Email Users Open To Attack | Everyone with a Gmail account is ‘at risk’ - billions told to follow 4 important rules