A phishing attack slipped past even the most advanced email security systems \u2014 and it did so by exploiting a trusted feature used by major tech companies like Google. Hackers found a clever loophole in DKIM, a protocol designed to verify emails. Instead, they turned it into a tool to send fake, perfectly authenticated messages that looked exactly like official Google alerts, reaching inboxes without raising any red flag<\/p>\n\n\n\n
The Setup:<\/strong><\/p>\n\n\n\n \ud83d\udfe2<\/strong> STAGE 1: Initial Setup \u2013 Gaining a Legitimate DKIM-Signed Email<\/strong><\/p>\n\n\n\n A threat actor begins by registering a new Google Account (e.g., me@maliciousdomain.com). They then create an OAuth application and cleverly name it with the entire phishing message content. Once the app is linked to their account, Google automatically sends a security notification to the attacker\u2019s email, alerting about new access granted.<\/p>\n\n\n\n Google Account & OAuth App Creation<\/strong><\/p>\n\n\n\n \u251c\u2500\u2500 Attacker creates a Google account (e.g., me@maliciousdomain.com)<\/p>\n\n\n\n \u251c\u2500\u2500 Attacker creates a custom OAuth app under this Google account<\/p>\n\n\n\n \u251c\u2500\u2500 The app is named deceptively<\/p>\n\n\n\n e.g., “Google Security Alert | Review details https:\/\/sites.google.com\/view\/account-verify-center<\/em>“,<\/p>\n\n\n\n “Legal Notice \u2013 Google | https:\/\/sites.google.com\/view\/account-verify-center <\/em>“<\/p>\n\n\n\n \u251c\u2500\u2500 Attacker authorizes this app with their own Google account.<\/p>\n\n\n\n \u2514\u2500\u2500 Google sends a real security alert email (e.g., \u201cA new app has access to your account\u201d) to the<\/p>\n\n\n\n attacker\u2019s Gmail account.<\/p>\n\n\n\n Here\u2019s the trick: This notification comes from no-reply@google.com<\/strong> and is DKIM-signed with valid DKIM signature<\/a> of google.com. It passes all the checks (SPF, DKIM, DMARC<\/a>), because it truly was sent from Google infrastructure.<\/p>\n\n\n\n \ud83d\udfe1<\/strong> STAGE 2: Replay Setup via Outlook & Email Capture<\/strong><\/p>\n\n\n\n Instead of crafting a new phishing email from scratch, the attacker cleverly reuses a legitimate, DKIM-signed security alert email sent by Google.<\/p>\n\n\n\n The attacker may use Outlook (or another mailbox) to store and extract the raw DKIM-signed message.<\/p>\n\n\n\n After receiving this email in their Outlook account (e.g., outlook-hack@outlook.com), the attacker extracts the entire raw message, including the headers and original DKIM signature, without making any modifications.<\/p>\n\n\n\n Capture DKIM-Signed Message<\/strong><\/p>\n\n\n\n \u251c\u2500\u2500 Attacker creates a free Outlook account (e.g., outlook-hack@outlook.com)<\/p>\n\n\n\n \u251c\u2500\u2500 Auto-Forwards<\/a> the Google alert to Outlook or receives it directly<\/p>\n\n\n\n \u2514\u2500\u2500 Attacker opens the message in Outlook and copies the raw source (includes headers, DKIM-Signature, and full body)<\/p>\n\n\n\n \u2705<\/strong> Note: Outlook is optional. The replay attack works as long as the attacker can get the raw DKIM-signed message and re-send it using a custom SMTP tool like Jellyfish.\u201d<\/strong><\/p>\n\n\n\n The Exploit:<\/strong><\/p>\n\n\n\n \ud83d\udfe0<\/strong> STAGE 3: Replaying the DKIM-Signed Email via Jellyfish<\/strong><\/p>\n\n\n\n The attacker leverages a custom SMTP tool like Jellyfish, which allows them to manually re-inject the raw email as-is. The forged email is then routed through an SMTP relay provided by Namecheap\u2019s Private Email service\u2014linked to a domain and mailbox under the attacker\u2019s control (e.g., relay@evil-relay.com).<\/p>\n\n\n\n Replaying the Email via Jellyfish<\/strong><\/p>\n\n\n\n \u251c\u2500\u2500 Attacker uses Jellyfish SMTP or a custom SMTP script<\/p>\n\n\n\n \u251c\u2500\u2500 Pastes the raw copied message into the tool<\/p>\n\n\n\n \u251c\u2500\u2500 Preserves the original DKIM-Signature and content<\/p>\n\n\n\n \u2514\u2500\u2500 Sets “From:” to no-reply@google.com<\/p>\n\n\n\n \u2705<\/strong> What Jellyfish does:<\/strong><\/p>\n\n\n\n \u2022 Accepts full raw email input (headers + body)<\/p>\n\n\n\n \u2022 Allows manually crafting headers, body, and DKIM signature<\/p>\n\n\n\n \u2022 Manually injects the crafted message through any relay SMTP server (like Namecheap)\u201d<\/p>\n\n\n\n \ud83d\udd34<\/strong> STAGE 4: Sends the Forged Email via Namecheap\u2019s SMTP Relay<\/strong><\/p>\n\n\n\n SMTP Relay via Namecheap<\/strong><\/p>\n\n\n\n \u251c\u2500\u2500 Attacker registers a domain via Namecheap (e.g., evil-relay.com)<\/p>\n\n\n\n \u251c\u2500\u2500 Purchases Namecheap Private Email plan<\/p>\n\n\n\n \u251c\u2500\u2500 Creates a mailbox (e.g., relay@evil-relay.com)<\/p>\n\n\n\n \u251c<\/strong>\u2500\u2500<\/strong> Configures SMTP settings in Jellyfish:<\/strong><\/p>\n\n\n\n \u2022 Host: mail.privateemail.com<\/p>\n\n\n\n \u2022 Port: 587 (STARTTLS)<\/p>\n\n\n\n \u2022 Auth: relay@evil-relay.com + password<\/p>\n\n\n\n \u251c\u2500\u2500 Jellyfish uses these details to open a secure SMTP connection to Namecheap\u2019s SMTP server.<\/p>\n\n\n\n \u2514\u2500\u2500 Sends the forged Google security alert via Jellyfish \u2192 through Namecheap SMTP<\/p>\n\n\n\n \u2705<\/strong> Result:<\/strong><\/p>\n\n\n\n \u2022 Email is sent from a non-Google server, but the DKIM signature is intact<\/p>\n\n\n\n \u2022 Passes the email security checks like DKIM and DMARC<\/a><\/p>\n\n\n\n As mentioned above the security alert message includes an App name which has a link to a Google Sites page added by the attacker. This site mimics Google’s official support page but contains buttons that lead to a fake login page. Once the user enters their credentials, they are directly captured by the attacker.<\/p>\n\n\n\n \ud83d\udd78\ufe0f<\/strong> Stage 5: Victim Sees the Received Fake Email<\/strong><\/p>\n\n\n\n \u251c\u2500\u2500 Email message body contains links controlled by attacker<\/p>\n\n\n\n \u251c<\/strong>\u2500\u2500<\/strong> These links point to a Google Sites page designed to mimic:<\/strong><\/p>\n\n\n\n \u2022 Google Support \u2022 Google Legal Notice \u2022 Account Recovery<\/p>\n\n\n\n \u251c\u2500\u2500 Page looks legitimate due to Google Sites domain<\/p>\n\n\n\n \u2514\u2500\u2500 Fake page contains a “Sign in” button \u2192 redirects to a credential harvesting form<\/p>\n\n\n\n \ud83d\udd13<\/strong> Step 5: Credential Harvesting<\/strong><\/p>\n\n\n\n \u2514\u2500\u2500 Victim enters login info on fake page \u2192 stolen by attacker<\/p>\n\n\n\n \ud83d\udd01<\/strong> Step 6: Ongoing Abuse<\/strong><\/p>\n\n\n\n \u251c\u2500\u2500 Attackers can update phishing pages anytime<\/p>\n\n\n\n \u2514\u2500\u2500 Hard to report abuse directly on Google Sites<\/p>\n\n\n\n Why it Worked:<\/strong><\/p>\n\n\n\n \u2705<\/strong> Genuine DKIM Signature:<\/strong><\/p>\n\n\n\n The attacker used a real Google-generated email that was already DKIM-signed. Since DKIM checks the message content and headers\u2014not the sending server\u2014it still passed validation after being auto-forwarded without any change in the email body .<\/p>\n\n\n\n \ud83c\udf10<\/strong> Trusted Google Infrastructure:<\/strong><\/p>\n\n\n\n The phishing link was hosted on Google Sites, a legitimate platform. Most filters don\u2019t flag Google domains, so the link looked safe and bypassed scrutiny.<\/p>\n\n\n\n \ud83d\udeab<\/strong> No Domain Spoofing Involved:<\/strong><\/p>\n\n\n\n The attacker didn\u2019t forge headers or spoof domains. They replayed a real email, which meant traditional anti-spoofing tools like SPF, DKIM, and DMARC didn\u2019t catch anything unusual.<\/p>\n\n\n\n \ud83d\udca1<\/strong> Legit-looking Content:<\/strong><\/p>\n\n\n\n The message mimicked a standard Google security alert and even included familiar buttons like \u201cView Case,\u201d which built trust with the recipient.<\/p>\n\n\n\n \ud83d\udce4<\/strong> Forwarding, Not Sending:<\/strong><\/p>\n\n\n\n The attacker forwarded the email using their own SMTP relay so while it came from elsewhere, the DKIM stayed intact\u2014tricking security systems.<\/p>\n\n\n\n Lessons Learned:<\/strong><\/p>\n\n\n\n Links, even under trusted domains, must be scrutinized.<\/strong><\/p>\n\n\n\n What to Do:<\/p>\n\n\n\n Always hover over the link to see the full URL.<\/p>\n\n\n\n Look for strange subpages, extra words, or odd formats.<\/p>\n\n\n\n Don\u2019t enter passwords or sensitive info unless you\u2019re sure the page is real.<\/p>\n\n\n\n Platforms should consider abuse reporting mechanisms for legacy tools like Google Sites.<\/strong><\/p>\n\n\n\n \ud83d\udd0d What is it?<\/strong><\/p>\n\n\n\n Legacy tools like Google Sites are older but still-active platforms. They often lack built-in abuse reporting or modern security checks.<\/p>\n\n\n\n \ud83d\udeab What can be prevented?<\/strong><\/p>\n\n\n\n Phishing attacks hosted on trusted domains due to efficient abuse reporting.<\/p>\n\n\n\n Credential theft from fake Google login pages built on Google Sites.<\/p>\n\n\n\n Best Practices for Prevention:<\/strong><\/p>\n\n\n\n 1. Email Gateway Filtering: Deploy advanced email filters that scan for suspicious content, URLs, and attachments.<\/p>\n\n\n\n 2. Multi-Factor Authentication (MFA): Require MFA for all critical systems to prevent unauthorized access\u2014even if credentials are stolen.<\/p>\n\n\n\n 3. Endpoint Protection: Use antivirus, anti-malware, and EDR tools on all devices.<\/p>\n\n\n\n 4. Access Controls: Apply the principle of least privilege to minimize damage if an account is compromised.<\/p>\n\n\n\n 5. Regular Patch Management: Keep all systems updated to close known vulnerabilities.<\/p>\n\n\n\n 6. User Awareness Training: Educate employees to recognize phishing emails, fake domains, and social engineering tactics. safe-support.co.uk<\/a> – Provides safety support services and professional assistance solutions.<\/p>\n\n\n\n meeventsphuket.com<\/a> – Event management company organizing experiences and celebrations in Phuket.<\/p>\n\n\n\n elhadaf-sd.com<\/a> – Online platform sharing regional news and community updates.<\/p>\n\n\n\n dizajn-enterijera.rs<\/a> – Website dedicated to interior design ideas and home d\u00e9cor inspiration.<\/p>\n\n\n\n sahafi.online<\/a> – Digital publication sharing journalism, articles, and commentary.<\/p>\n\n\n\n abhayagroup.com<\/a> – Corporate website presenting services and projects of Abhaya Group.<\/p>\n\n\n\n aircoldventilation.com<\/a> – Specialists in air conditioning, ventilation, and cooling systems.<\/p>\n\n\n\n alchemygranimarmo.com<\/a> – Showcases marble, granite, and stone surface solutions.<\/p>\n\n\n\n brahminsocials.com<\/a> – Platform focused on social media marketing and branding strategies.<\/p>\n\n\n\n chainlinkservices.in<\/a> – Offers technical services and business solutions for enterprises.<\/p>\n\n\n\n contactsmil.com<\/a> – Online service helping manage contacts and communication tools.<\/p>\n\n\n\n dareenrealty.com<\/a> – Real estate website presenting property listings and housing projects.<\/p>\n\n\n\n gaaq.in<\/a> – Technology-focused site covering digital tools and innovation topics.<\/p>\n\n\n\n ganavacademy.com<\/a> – Educational platform offering training programs and learning resources.<\/p>\n\n\n\n hallmarkevents.co.in<\/a> – Event planning service delivering professional celebration management.<\/p>\n\n\n\n heartfailurefoundation.org<\/a> – Nonprofit organization promoting awareness of heart health.<\/p>\n\n\n\n inspirepeopleconsultancy.com<\/a> – Consultancy helping businesses improve leadership and development.<\/p>\n\n\n\n kanditree.com<\/a> – Blog sharing lifestyle insights and creative digital content.<\/p>\n\n\n\n oasisamr.com<\/a> – Company providing professional solutions and corporate services.<\/p>\n\n\n\n riomedsystemspvt.com<\/a> – Supplier of medical systems and healthcare equipment.<\/p>\n\n\n\n softfurnishingfzc.com<\/a> – Business offering curtains, fabrics, and interior furnishing products.<\/p>\n\n\n\n teras360.com<\/a> – Platform discussing technology, innovation, and modern digital trends.<\/p>\n\n\n\n sonrisa-smiles.com<\/a> – Dental clinic website promoting professional smile care.<\/p>\n\n\n\n vivienda.solar<\/a> – Initiative focused on solar housing and renewable energy living.<\/p>\n\n\n\n olivehouse2u.com<\/a> – Home living brand presenting d\u00e9cor and lifestyle products.<\/p>\n\n\n\n aafiyatacademy.com<\/a> – Educational academy delivering courses and training programs.<\/p>\n\n\n\n aafiyatcommunity.com<\/a> – Community platform sharing lifestyle and wellness content.<\/p>\n\n\n\n aafiyatlifestyle.com<\/a> – Lifestyle website discussing health, habits, and daily inspiration.<\/p>\n\n\n\n olivehouse.com.my<\/a> – Malaysian lifestyle brand presenting home living concepts.<\/p>\n\n\n\n elshani-gartenbau.de<\/a> – German landscaping company offering garden construction services.<\/p>\n\n\n\n begaj-bau.de<\/a> – Construction business specializing in building projects.<\/p>\n\n\n\n bhgebaeudereinigung.de<\/a> – Cleaning service provider for residential and commercial properties.<\/p>\n\n\n\n dachdeckerei-gashi.de<\/a> – Roofing contractor offering installation and repair services.<\/p>\n\n\n\n e1-transport.ch<\/a> – Transportation and logistics company based in Switzerland.<\/p>\n\n\n\n elshani-dachtechnik.de<\/a> – Roofing technology and construction specialist.<\/p>\n\n\n\n gartenservice-pronaj.de<\/a> – Garden maintenance and landscaping services.<\/p>\n\n\n\n istogu-stuckateur.de<\/a> – Plastering and finishing contractor for buildings.<\/p>\n\n\n\n kokollari-bau-seko.at<\/a> – Austrian construction company handling building projects.<\/p>\n\n\n\n lea-malereibetrieb.de<\/a> – Professional painting and renovation service.<\/p>\n\n\n\n lumi-reinigung.de<\/a> – Cleaning service delivering hygiene solutions.<\/p>\n\n\n\n lundl-reinigung.de<\/a> – Facility cleaning company offering maintenance services.<\/p>\n\n\n\n lutfishala-gartenbau.de<\/a> – Landscaping company focused on outdoor design.<\/p>\n\n\n\n maderas-group.com<\/a> – Business working with wood materials and construction supplies.<\/p>\n\n\n\n malerkoko.at<\/a> – Austrian painting contractor for residential and commercial buildings.<\/p>\n\n\n\n sr-dienstleistungen.de<\/a> – Service provider offering multiple professional solutions.<\/p>\n\n\n\n tarashaj-gmbh.de<\/a> – German company providing construction and service projects.<\/p>\n\n\n\n uraebashkuar.com<\/a> – Website sharing community stories and cultural content.<\/p>\n\n\n\n egsgambetta.com<\/a> – Educational institution website presenting school information.<\/p>\n\n\n\n leykunart.com<\/a> – Portfolio site displaying creative artwork and designs.<\/p>\n\n\n\n dumanimail.in<\/a> – Email communication service and digital messaging tools.<\/p>\n\n\n\n sugov.co<\/a> – Platform discussing governance topics, policy insights, and public initiatives.<\/p>\n\n\n\n forums-fec.be<\/a> – Community forum enabling discussions and knowledge sharing.<\/p>\n\n\n\n ostringsrallyteam.se<\/a> – Rally racing team website sharing updates and motorsport activities.<\/p>\n\n\n\n codeschoolafrica.com<\/a> – Coding education platform supporting technology learning in Africa.<\/p>\n\n\n\n creativepluck.com<\/a> – Creative agency sharing ideas about branding and digital design.<\/p>\n\n\n\n techher4change.org<\/a> – Initiative empowering women through technology education.<\/p>\n\n\n\n yeraldshomes.com.ng<\/a> – Nigerian real estate platform featuring housing opportunities.<\/p>\n\n\n\n yeraldssignature.com<\/a> – Property brand showcasing premium residential developments.<\/p>\n\n\n\n saveey.com.au<\/a> – Website offering saving tips and financial management tools.<\/p>\n\n\n\n ekaminingsolutions.com<\/a> – Mining solutions provider offering equipment and services.<\/p>\n\n\n\n drillmyborewells.com<\/a> – Borewell drilling service specializing in groundwater solutions.<\/p>\n\n\n\n ekaconveyors.com<\/a> – Manufacturer of industrial conveyor systems.<\/p>\n\n\n\n ekainstruments.com<\/a> – Supplier of precision instruments and industrial tools.<\/p>\n\n\n\n ekavfd.com<\/a> – Company delivering variable frequency drive solutions.<\/p>\n\n\n\n flotronics.in<\/a> – Industrial automation and instrumentation solutions provider.<\/p>\n\n\n\n pumpingsolutions.in<\/a> – Supplier of pumps and fluid transfer technologies.<\/p>\n\n\n\n skyrootsdigital.com<\/a> – Digital marketing agency offering branding and growth strategies.<\/p>\n\n\n\n skyrootslogistics.com<\/a> – Logistics company providing transport and supply chain services.<\/p>\n\n\n\n skyrootstoursandtravels.com<\/a> – Travel agency organizing tours and holiday packages.<\/p>\n\n\n\n synergyspray.in<\/a> – Industrial spray equipment manufacturer.<\/p>\n\n\n\n trueaircon.com<\/a> – Air conditioning service provider offering installation and repair.<\/p>\n\n\n\n homeopatbreclav.cz<\/a> – Clinic providing homeopathic treatments and natural therapies.<\/p>\n\n\n\n internat-4.ru<\/a> – Educational institution website sharing school information.<\/p>\n\n\n\n itsfiretime.com<\/a> – Platform promoting fire safety awareness and training.<\/p>\n\n\n\n schooldirect.org<\/a> – Education initiative supporting teacher training programs.<\/p>\n\n\n\n gosialondon.co.uk<\/a> – Lifestyle and beauty services based in London.<\/p>\n\n\n\n nomologos.gr<\/a> – Legal consulting website sharing law-related insights.<\/p>\n\n\n\n cjkbim.com<\/a> – BIM engineering and digital construction services provider.<\/p>\n\n\n\n strimkoua.com<\/a> – Digital services platform presenting technology solutions.<\/p>\n\n\n\n ktaxservices.com<\/a> – Financial consultancy offering tax and accounting services.<\/p>\n\n\n\n stiripiatraneamt.ro<\/a> – Romanian news website covering local updates.<\/p>\n\n\n\n
ingcannella.com<\/a> – Personal website featuring creative ideas, articles, and digital projects.<\/p>\n\n\n\n