New Crypto Scam: Google Emails Bypass Filters, Target Traders’ Passwords & 2FA Codes

by

New Phishing Scam Uses Google Email System to Target Crypto Users

Show AI Summary
A new phishing campaign exploits Google’s email system to target crypto traders with sophisticated attacks.
The attack bypasses standard spam filters by using legitimate Google security notifications to deliver malicious links.
Crypto traders are particularly vulnerable to this threat, which can harvest sensitive exchange passwords and authentication codes.

A recent scam is tricking cryptocurrency traders by exploiting Google’s email system. Attackers are using legitimate Google features designed for account recovery to send fake security alerts directly into Gmail inboxes. These alerts contain dangerous links and are designed to look real, effectively bypassing typical spam and security protections that users depend on to identify fraudulent emails.

Security experts have discovered a new, more advanced phishing technique. Instead of creating fake emails that *look* like they’re from Google, attackers are now manipulating the real Google system to send emails containing harmful software.

I recently encountered a clever phishing attempt: someone misused a legitimate Google account recovery contact form. They hid a phishing link at the very bottom of a long message, burying it after several blank pages to make it harder to spot.

— Jameson Lopp (@lopp) May 17, 2026

How the Attack Works

As an analyst, I’ve been examining a phishing technique that cleverly uses a real Google security feature. It centers around the account recovery contact request. Essentially, the attacker sends a request to the victim, and this triggers a legitimate-looking email from Google itself. This makes it appear much more trustworthy than a typical phishing attempt.

Since the email comes directly from Google’s servers, it successfully passes common email security checks like SPF, DKIM, and DMARC – the methods Gmail and other email services use to confirm the sender is who they claim to be. It also looks just like other legitimate Google security notifications, appearing in the same conversation thread, making it difficult to spot as fake at first.

Harmful links are concealed within emails by using extra spaces to push them below what you initially see. The email often starts with a convincing message that looks like a real Google security alert – such as a request to recover or review an account. However, the dangerous link is hidden further down, forcing users to scroll past seemingly legitimate information to find it.

The Crypto-Specific Threat

This type of attack is especially risky for people who use or own cryptocurrency. Clicking a link to a fake login page can steal their exchange passwords, active login information, or security codes. If a hacker gets access to a logged-in account, they can even bypass two-factor authentication and withdraw funds before the owner knows what’s happening.

Attackers can also trick users during wallet approval processes. If someone visits a fake website that looks like a legitimate DeFi platform or wallet, they might accidentally approve a harmful transaction. This is a common scam – known as “approval phishing” – that has already affected over 20,000 wallets in 30 countries, as discovered by Operation Atlantic earlier this year.

It’s important to understand how this attack differs from typical phishing scams. Many cryptocurrency users are already careful about checking sender addresses and looking for signs of fraud. However, because this attack originates from Google’s own servers within a real security alert, those usual checks don’t work, and users are more likely to be caught off guard.

A Phishing Epidemic in 2026

As a crypto investor, it’s really concerning to hear about this Google infrastructure exploit, especially since we’re already seeing a huge spike in phishing attacks right now. It feels like scammers are working overtime, and this just adds another layer of risk.

In the first quarter of 2026, Binance prevented roughly 22.9 million scams and phishing attacks – a 54% jump from the previous quarter. This protection helped safeguard about $1.98 billion belonging to its users. Binance now uses artificial intelligence to identify phishing attempts across email, text messages, and messages within the app all at the same time.

Last April, Coinbase, Microsoft, and Europol shut down a large phishing operation called Tycoon 2FA. Europol reported this network sent out tens of millions of phishing emails each month, specifically targeting people who use cryptocurrency exchanges. What made this network dangerous was its ability to steal two-factor authentication codes as they were being sent, effectively turning a security feature into a way for hackers to gain access to accounts.

Last week, the security firm SlowMist alerted TRON users to a dangerous fake browser extension on the Chrome Web Store. This extension disguised itself using tricky characters to steal sensitive information like private keys and passwords. Separately, the South Korean exchange Bithumb started a new campaign against phishing attacks on May 14th. These attacks are increasing, and now use artificial intelligence and ‘deepfake’ technology to convincingly imitate exchange staff during phone calls, targeting crypto investors.

Why Standard Security Checks Fail

The recent Google recovery contact issue reveals a core problem with how email security works, especially for cryptocurrency users. Current email security standards – SPF, DKIM, and DMARC – focus on verifying where an email *comes from*, not *who* is actually sending it or their intentions. These systems check if the sending server is legitimate and if the email has been altered, but they don’t confirm that the sender is who they claim to be.

If a hacker manages to send a malicious message disguised as a real email from Google, standard security checks won’t catch it. These checks confirm the email truly originated from Google, but they can’t tell if the information *within* the email is safe or part of a phishing attempt.

The recent Google email exploit shares a core weakness seen in wallet-signing interfaces throughout 2026. These interfaces often make it difficult for users to tell the difference between genuine and harmful transaction requests, which is why Ethereum developed the ERC-7730 Clear Signing standard. Like those interfaces, the Google exploit appears legitimate and passes initial security checks, but is actually designed to be harmful.

Read More

2026-05-18 15:18