Urgent warning issued: Billions of Gmail users targeted in alarming new phishing scam

‎A new and deeply concerning cyberattack is targeting Gmail users worldwide, prompting urgent warnings from security experts and Google itself. The threat, described as an “extremely sophisticated” phishing campaign, utilizes artificial intelligence and verified email signatures to deceive even the most vigilant users.

‎

Billions of Gmail users at risk from AI-powered phishing scam that bypasses Google security.

‎Getty Images (2)

‎

‎Cybercriminals are exploiting cutting-edge AI tools to generate hyper-realistic phone calls and seemingly legitimate emails—some of which appear to originate directly from Google’s official no-reply@google.com address. These messages have passed digital signature checks like DKIM (DomainKeys Identified Mail), allowing them to slip past spam filters and security alerts, appearing entirely genuine to unsuspecting recipients.

‎

‎After the phone call, victims receive a follow-up email that directs them to a fake website mimicking Google’s login page, crafted to harvest their login credentials and potentially give the attackers full access to Gmail accounts and linked Google services.

‎

‎The scam has been so convincing that even security-conscious developers have been caught off guard. Nick Johnson, a respected figure in the developer community, shared his own experience after receiving a forged legal subpoena demanding access to his Google account content. Alarmingly, the email passed all standard verification checks and was grouped alongside legitimate security alerts in his inbox.

‎

‎"The first thing to note is that this is a valid, signed email — it really was sent from no-reply@google.com," Johnson wrote on social media. "It passes the DKIM signature check, and Gmail displays it without any warnings."

‎

‎Google Confirms Attack, Warns Users

‎

‎In response to growing reports, a Google spokesperson confirmed that the phishing campaign is the work of a threat actor group identified as Rockfoils. The company has rolled out new security protections in recent days and expects them to be fully deployed shortly. However, users are urged to take proactive steps in the meantime.

‎

‎“We encourage users to adopt two-factor authentication and passkeys, which provide strong protection against these kinds of phishing campaigns,” Google stated.

‎

‎Security Experts Call for Vigilance

‎

‎Spencer Starkey, Vice President at cybersecurity firm SonicWall, emphasized the need for companies like Google to stay one step ahead of evolving threats.

‎

‎"Cybercriminals are constantly developing new tactics, techniques, and procedures to exploit vulnerabilities and bypass security controls," Starkey said. "This requires a proactive and flexible approach to cybersecurity."

‎

‎What You Should Do Now:

‎

‎ • Enable Two-Factor Authentication (2FA) and Passkeys on your Google account.

‎

‎ • Avoid clicking links in unexpected emails, even those that appear official.

‎

‎ • Access Google directly by typing the address into your browser, rather than following links.

‎

‎ • Report phishing by using Gmail’s “Report phishing” tool.

‎

‎This attack underscores how even the most secure platforms are not immune to evolving threats. Vigilance and updated security practices remain the best defense.