Phishing 2.0 Bypasses Email Filters –

In a rapidly evolving cyber threat landscape, phishing attacks continue to grow more sophisticated, leveraging novel techniques to bypass even the most advanced security measures. A recent phishing campaign has raised alarm bells, not just for its cleverness but also for its ability to bypass traditional email security systems — even fooling Gmail completely.

Here’s a deep dive into this attack and how we help you stay protected from such threats.

Phishers Exploit Google Sites and DKIM Replay

Described by researchers as an “extremely sophisticated phishing attack,” this campaign used a combination of trusted platforms and clever technical manipulation to trick users into handing over their credentials.

How the Attack Worked:

Emails Sent Via Google Infrastructure

– The phishing emails used real Google email servers and included valid DKIM signatures, making them appear legitimate.

– The emails passed all authentication checks, including SPF, DKIM, and DMARC, fooling most email filters.

Trusted Hosting on Google Sites

– Fake login pages were hosted on sites.google.com, a trusted platform.

– These pages mimicked Google Support, urging victims to click links to “view case materials” or “upload additional documents.”

DKIM Replay Attack

– Attackers exploited a DKIM replay technique to ensure their emails passed authentication.

– They created a Google Account and an OAuth application tied to it, generating a legitimate Google “Security Alert” email.

– This email was forwarded via third-party infrastructure, keeping the DKIM signature intact, ensuring it bypassed security filters.

Convincing Tactics

– The email appeared to come from “[email protected]” with a “Signed by” header indicating authenticity.

– The phishing page replicated Google login forms, hosted on Google Sites, making detection even harder.

Wider Implications of Advanced Phishing

This attack is part of a broader trend where cybercriminals exploit:

– Trusted Platforms: Using Google Sites or other reputable services to host malicious content.

– Obscure Techniques: Leveraging DKIM replay or exploiting attachment formats like SVG to embed malicious code.

– Sophisticated Methods: Creating realistic scenarios, such as subpoenas or account issues, to manipulate victims.

In 2025 alone, phishing attacks using SVG attachments have surged, with over 4,100 emails detected. These emails redirect users to fake login forms for services like Google Voice or Microsoft.

How We Keep You Protected – Before, During, and After Attacks

Traditional defenses are no longer enough. That’s why we provide multi-layered security solutions to protect your organization at every stage of an attack.

1. Advanced Email Threat Protection

Go beyond SPF, DKIM, and DMARC checks to detect sophisticated phishing attempts:

– AI-Powered Analysis: Detects suspicious language, behavior patterns, and link structures.

– URL Sandboxing: Even “trusted” domains like Google Sites are analyzed for phishing behavior.

– Behavioral Insights: Identifies anomalies in email patterns to flag potential threats.

2. Multi-Factor Authentication (MFA) & Risk-Based Access Control

Block unauthorized access even if credentials are compromised:

– Risk-Based Decisions: Access is granted based on user behavior, location, and device type.

– Passwordless Login: Reduces reliance on passwords, minimizing exposure to phishing.

– Dynamic MFA: Adapts challenges based on real-time risk levels.

3. Fake Website & Brand Monitoring

Monitor and protect your brand against lookalike phishing sites:

– Phishing Domain Scanning: Detects fake websites impersonating your brand.

– Trusted Platform Monitoring: Identifies malicious content on Google Sites and similar platforms.

– Rapid Takedowns: Quickly removes phishing pages before they spread.

4. User Awareness Training & Phishing Simulations

Your employees are your first line of defense:

– Real-World Simulations: Trains users to recognize phishing tactics like urgency cues and mismatched domains.

– Continuous Learning: Builds a culture of security awareness through engaging, ongoing programs.

5. Browser Isolation & Cloud Data Controls

Prevent users from falling victim to phishing:

– Credential Protection: Stops users from entering credentials on suspicious forms.

– Data Access Management: Limits sensitive data exposure on unsanctioned apps or shadow IT platforms.

6. Behavior Monitoring & Rapid Response

Detect, contain, and respond to threats in real-time:

– Post-Login Monitoring: Tracks user behavior for signs of account compromise.

– Seamless Integration: Works with your SIEM for centralized threat detection and response.

What Google is Doing

After the discovery of this attack, Google rolled out fixes to shut down the abuse pathways. The company emphasized that it never requests credentials like passwords or one-time codes in emails and encouraged users to adopt two-factor authentication (2FA) and passkeys as added protection.

Conclusion

This isn’t phishing as we’ve known it — it’s smarter, more trusted, and far more dangerous. Cybercriminals are leveraging legitimate platforms and advanced techniques to bypass traditional defenses.

Don’t wait until your organization becomes the next target. Contact Us Today to learn how our comprehensive security solutions can safeguard your business against even the most sophisticated threats.