Jameson Lopp warns of Google phishing sent from Google's own servers

On Thursday, Casa’s Jameson Lopp warned that a phishing scam was using Google’s own servers to send fake emails whose links led to fraudulent login pages. Crypto holders face particular risk because those pages can capture passwords, session data and two-factor codes. Lopp had warned in May about a different scam that exploited Google’s account-recovery form. Check Point separately found attackers abused a Google Cloud Application Integration email feature to send 9,394 messages to about 3,200 organizations over two weeks in December 2025 from a genuine Google address; Google said it blocked the campaigns and attributed them to misuse of an automation tool, not a breach.