Just when you think you've got a handle on online security, something else will appear on your feed. This time, it's a new Gmail attack that's got everyone talking. Google has confirmed a new attack that uses weaknesses in their system along with clever scams.
This latest attack first surfaced on X and in the crypto circles, which makes sense since the initial victim was none other than an Ethereum developer, Nick Johnson. He described it as an "extremely sophisticated phishing attack" that "exploits a vulnerability in Google’s infrastructure." What's even more concerning is his warning that because Google hasn't fixed it yet, we're likely to see a lot more of this.
The attack itself is disturbingly clever. It starts with an email that looks completely legitimate, coming from a genuine Google address. Johnson pointed out that it was sent from no-reply@google.com, passed all the security checks, and Gmail happily placed it right alongside his other real security alerts.
Even if you have two-step verification (where you get a code on your phone), it's not enough anymore, especially if those codes come by text message. It's too easy for these attackers to steal your password and those text message codes.
The scary part is how they pulled this off. Apparently, these attackers found a way to send a correctly formatted Google email to themselves from Google. They can then forward copies, and because it retains that original legitimate signature, it looks the real deal. But the end goal is the same old trick: a fake login page designed to steal your credentials.
Thankfully, Google has acknowledged this. They've said they're "aware of this class of targeted attack" and have been rolling out protections over the past week, promising a full deployment soon to shut down this method of abuse. In the meantime, their advice is blunt: get on two-factor authentication and, even better, start using passkeys. They emphasize that these offer much stronger defense against these kinds of phishing attempts.
What really helps? Passkeys. These are like digital keys linked to your phone or computer. To log in, you need to unlock your device – so if an attacker doesn't have your phone, they can't get in, even if they have your password. Google isn't getting rid of passwords completely yet, but you should stop using them to log in.
These smart attacks, and the ones we've seen lately, can be stopped if you update your security. And with AI getting better, these kinds of attacks will become much more common. Microsoft even warned that AI is making it easier for criminals to create believable scams.
You can find out how to add a passkey to your Google account – you should do it today.
The news is full of this latest Gmail problem, but the main point is simple: Google will never email you out of the blue about security issues or ask you to do something to stay safe. Also, if you follow their security advice, your account will be much safer.
Set up passkeys now if you haven't. And remember, just like with bank scams, if someone contacts you pretending to be Google and asking you to do something, it's a scam. It's a constant fight, and it's getting tougher. Google's old advice to just use two-step verification isn't good enough anymore, especially if it's just text messages.
Don't just rely on two-step verification, especially not text messages. There are other security keys you can use, but passkeys are the easiest. If you use Gmail, all three billion of you should set up passkeys now. Google is moving away from text message codes, and you should too. In your account settings, turn on an authenticator app or Google prompts on your other devices as well – and definitely use a passkey.
If you have strong security like this, you don't have to worry as much about how clever the attacks are. But you need to stop typing in your password to log in, and make sure your two-step verification is stronger than just text messages. Google and others still let you use passwords as a backup, even with passkeys, and that's a weak spot.
Think about it: if someone gets into your email, they can probably get into everything else linked to it, like your bank or social media. They can ask for password resets and see security alerts.
You've been warned. Do this now to protect yourself.
