Skip to content
New Google Phishing Scam Exploits Google's Own Infrastructure

New Google Phishing Scam Exploits Google's Own Infrastructure

First seen 31 Oct 2026, 05:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 31, 2026 at 07:13 UTC
  • •Phishing emails sent from Google's own servers bypass security filters.
  • •Over 9,000 emails were sent to target cryptocurrency holders.
  • •Google claims to have blocked the phishing campaigns but warns of ongoing risks.

Jameson Lopp, co-founder of Casa, alerted users to a phishing scam utilizing Google's infrastructure to send fraudulent emails. The scam targets cryptocurrency holders, directing them to fake login pages that capture sensitive information. Attackers exploited Google Cloud's Application Integration tool to send over 9,000 emails, bypassing standard email security checks. Users reported that clicking the links led to a phishing page disguised as a legitimate login portal. Google stated that it blocked the campaigns, attributing the issue to misuse of its automation tools rather than a security breach. This type of phishing attack has previously been seen with other Google services. Crypto users are particularly vulnerable due to the nature of the scams. The incident highlights ongoing challenges in combating sophisticated phishing techniques.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-29
Jameson Lopp warns of phishing scam
Lopp posted on X about a new phishing scam using Google's infrastructure to send emails, including a screenshot of the scam email.
Kucoin
2026-10-31
Cryptopolitan reports on phishing scam
Cryptopolitan published an article detailing the phishing scam and its implications for crypto account holders, citing Lopp's warnings.
Cryptopolitan

More articles in this cluster (2)

Following this threat?

Track Google in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

How can I identify these phishing emails?
Look for emails that appear to come from Google but contain suspicious links or requests for sensitive information.
What should I do if I clicked the link?
Change your passwords immediately and enable two-factor authentication on your accounts.
Is Google taking any action against these scams?
Google has stated that it blocked the campaigns and is working to address the misuse of its tools.