Jameson Lopp warns of Google phishing sent from Google's own servers

Casa’s Jameson Lopp warned on Thursday about a new phishing scam that sends fake emails through Google’s own systems.

Crypto holders face the biggest risk from this scam due to the use of fake login pages to steal passwords and other sensitive data. 

How can a scam email come from Google itself?

Casa’s Jameson Lopp has warned on X that there’s a new version of an old scam currently running. He posted a screenshot of the scam email, which is sent through Google’s actual servers in order to make it look real. 

New flavor of Google phishing that abuses Google's own infrastructure to send you this email. If you click the https://t.co/H9sDdmX0PF link you end up at a phishing login page. pic.twitter.com/dfkvfibo33

— Jameson Lopp (@lopp) October 29, 2026

The post explains that when a user clicks the link in the email, they will be sent to a fake login page. 

In May, Lopp shared another scam that used Google’s account recovery form. The attacker wrote a very long message in the form, keeping a notice that looked real at the top and the scam link far below it, after a lot of empty space. The alert in this incident came through Google’s real account systems.

Check Point (NASDAQ: CHKP) found a campaign that misused the “Send Email” feature in Google Cloud’s Application Integration tool. Over a period of two weeks in December 2025, attackers sent 9,394 emails to about 3,200 organizations and the emails came from a real Google address, [email protected], so they passed DMARC and SPF checks. 

People who clicked the links in the emails were first sent through several trusted Google web addresses. Next, they saw a fake CAPTCHA page that stopped automatic security scanners. After that, they landed on a fake Microsoft (NASDAQ: MSFT) login page that was not hosted by Microsoft.

Google (NASDAQ: GOOGL) told the researchers it had blocked the campaigns. It said the problem came from the misuse of an automation tool, not from a break-in to its systems.

Similar scams have reportedly been carried out through Google Meet, DoubleClick, Google Analytics and other services.

Why are crypto holders targeted so often?

Crypto exchange users and wallet holders are especially at risk because fake login pages can be used to steal passwords, session data or two-factor codes. 

Cryptopolitan reported just this week that scammers used leaked API keys from Cloudflare (NYSE: NET) to send emails from Foundation’s own domains. Some recipients said the scam emails they received had legitimate details like their names, addresses and past Passport purchases. 

Foundation has since revoked the keys and said the funds on its devices are safe.

Notably, Binance said it blocked 22.9 million scam and phishing attempts in the first quarter of 2026, 54% more than the quarter before. It also said it protected about $1.98 billion in user funds.