- Jameson Lopp warned on Thursday about a Google phishing campaign that sends scam emails from Google’s own infrastructure.
- The messages bypass filters that would catch ordinary spoofing, putting Google and crypto account holders at risk.
- Researchers tracked a December campaign of nearly 9,400 emails to recent wallet-maker scams.
Casa’s Jameson Lopp warned on Thursday about a new phishing scam that sends fake emails through Google’s own systems.
Crypto holders face the biggest risk from this scam due to the use of fake login pages to steal passwords and other sensitive data.
How can a scam email come from Google itself?
Casa’s Jameson Lopp has warned on X that there’s a new version of an old scam currently running. He posted a screenshot of the scam email, which is sent through Google’s actual servers in order to make it look real.
New flavor of Google phishing that abuses Google’s own infrastructure to send you this email. If you click the https://t.co/H9sDdmX0PF link you end up at a phishing login page. pic.twitter.com/dfkvfibo33
— Jameson Lopp (@lopp) October 29, 2026
The post explains that when a user clicks the link in the email, they will be sent to a fake login page.
In May, Lopp shared another scam that used Google’s account recovery form. The attacker wrote a very long message in the form, keeping a notice that looked real at the top and the scam link far below it, after a lot of empty space. The alert in this incident came through Google’s real account systems.
Check Point (NASDAQ: CHKP) found a campaign that misused the “Send Email” feature in Google Cloud’s Application Integration tool. Over a period of two weeks in December 2025, attackers sent 9,394 emails to about 3,200 organizations and the emails came from a real Google address, [email protected], so they passed DMARC and SPF checks.
People who clicked the links in the emails were first sent through several trusted Google web addresses. Next, they saw a fake CAPTCHA page that stopped automatic security scanners. After that, they landed on a fake Microsoft (NASDAQ: MSFT) login page that was not hosted by Microsoft.
Google (NASDAQ: GOOGL) told the researchers it had blocked the campaigns. It said the problem came from the misuse of an automation tool, not from a break-in to its systems.
Similar scams have reportedly been carried out through Google Meet, DoubleClick, Google Analytics and other services.
Why are crypto holders targeted so often?
Crypto exchange users and wallet holders are especially at risk because fake login pages can be used to steal passwords, session data or two-factor codes.
Cryptopolitan reported just this week that scammers used leaked API keys from Cloudflare (NYSE: NET) to send emails from Foundation’s own domains. Some recipients said the scam emails they received had legitimate details like their names, addresses and past Passport purchases.
Foundation has since revoked the keys and said the funds on its devices are safe.
Notably, Binance said it blocked 22.9 million scam and phishing attempts in the first quarter of 2026, 54% more than the quarter before. It also said it protected about $1.98 billion in user funds.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
What did Jameson Lopp warn about?
Casa's Jameson Lopp flagged a new phishing variant that abuses Google's own infrastructure to send emails, with a link that leads clickers to a phishing login page, according to his post on X.
How do these emails get past spam filters?
Because they originate from genuine Google addresses, they carry legitimate authentication and clear checks like DMARC and SPF, so filters and sender-reputation tools let them through, as Check Point documented.
How large was the December campaign researchers tracked?
Check Point recorded 9,394 phishing emails sent to roughly 3,200 organizations over 14 days in December 2025, routed through trusted Google domains to a fake Microsoft login page.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
