A sophisticated phishing campaign is targeting Gmail users by sending emails that appear to originate from Google’s official address, “no-reply@google.com.” These emails claim that the recipient’s account is under legal scrutiny, urging them to click on a link to review purported subpoena details.​

The scam exploits Google’s own infrastructure by using the Google Sites platform to host counterfeit support pages. These pages closely mimic legitimate Google interfaces, making it challenging for users to discern the fraud. The attackers have managed to bypass standard email authentication protocols, such as DomainKeys Identified Mail (DKIM), allowing these phishing emails to pass through spam filters and appear in the same conversation threads as genuine Google alerts.

Nick Johnson, a developer with the Ethereum Name Service, was among those targeted. He reported the incident to Google, highlighting the misuse of Google’s OAuth applications. Initially, Google dismissed the concern, stating it was “working as intended.” However, the company has since acknowledged the vulnerability and is working on a fix.

In response to this threat, Google advises users to enable two-factor authentication (2FA) and consider adopting passkeys for enhanced security. Passkeys are cryptographic credentials that provide a more secure alternative to traditional passwords and are resistant to phishing attacks.

Users are urged to exercise caution with unsolicited emails, especially those requesting personal information or prompting immediate action. It’s recommended to verify the authenticity of such messages by accessing account settings directly through Google’s official website, rather than clicking on links within the email.​

To report suspicious emails, Gmail users can use the “Report phishing” option found in the three-dot menu of the message. This helps Google identify and mitigate similar threats in the future.​

Nearly one million computers worldwide fell victim to a sprawling cyberattack last month that exploited an unlikely combination: people looking for free movies and the trusted software platform GitHub.

Microsoft’s threat intelligence team disclosed the campaign in December 2024, describing an operation that turned websites hosting pirated content into traps for unsuspecting users. The attack represented a troubling evolution in how cybercriminals distribute malware by hiding in plain sight on legitimate platforms.

The scheme worked like this: Someone searching for a free stream of the latest blockbuster would land on an illegal streaming site. But embedded in those sites were malicious advertisements that quietly redirected visitors through a chain of websites before depositing them on GitHub, where attackers had uploaded software that appeared benign but contained dangerous payloads.

Users who downloaded and ran these files handed over access to their computers. The malware quickly got to work cataloging system information and installing additional programs, including Lumma, a tool designed to steal passwords and financial data. The attackers also deployed an updated variant of Doenerium and used NetSupport, a legitimate remote access program typically used by IT departments, to maintain control of infected machines.

The broad targeting meant the campaign hit both home computers and corporate networks across multiple industries. Security researchers say using GitHub complicates detection efforts because the platform hosts millions of legitimate software projects, making it harder for security tools to distinguish between safe and malicious files.

Microsoft did not identify the attackers or specify which countries saw the highest infection rates. The company’s disclosure comes as cybersecurity experts have grown increasingly concerned about malvertising, a technique that has proven effective because it requires no special action from victims beyond visiting a compromised website.

For users, the incident offers a reminder that piracy sites carry risks beyond legal trouble. Security experts recommend sticking to legitimate streaming services and keeping antivirus software up to date. Organizations should block access to known piracy domains on corporate networks and train employees to recognize suspicious download requests.

The attackers’ decision to weaponize GitHub highlights how cybercriminals adapt their methods to exploit trust in widely used platforms, making traditional security approaches less effective.

More than eight in ten Americans say they’re worried about cybersecurity when banking online, according to a recent survey, a finding that reflects mounting anxiety over whether financial institutions can protect customer data in an increasingly digital economy.

The concern isn’t entirely misplaced. Earlier this year, Barclays customers in the UK couldn’t access their money for three days after an IT failure knocked out the bank’s systems from January 31 through February 2. More than half of all payments failed during the outage, and the bank has set aside £7.5 million to compensate affected customers. In the United States, Bank of America customers reported logging in to find their balances had vanished, a technical glitch that sent many scrambling to customer service lines.

What makes these incidents particularly troubling is that they weren’t even cyberattacks. There were internal system failures at some of the world’s largest banks, institutions that spend billions on technology infrastructure. When hackers do get involved, the damage can be far worse.

The International Monetary Fund reported last year that extreme losses from cyber incidents have more than quadrupled since 2017, with some attacks causing $2.5 billion in damages. The fund warned that losses of this scale could threaten the solvency of major companies, raising questions about whether the financial sector is keeping pace with increasingly sophisticated threats.

Interestingly, the survey found that 52 percent of respondents believe online-only banks actually have better cybersecurity than traditional institutions. That perception may reflect a belief that digital-native companies, built from the ground up with modern technology, are better positioned to defend against contemporary threats than older banks running on legacy systems.

Security experts say customers can take steps to protect themselves regardless of where they bank. Strong passwords remain essential, and financial institutions have been pushing customers to enable multi-factor authentication, which requires a second form of verification beyond just a password. Keeping software updated, watching for phishing emails, and regularly checking account statements for unauthorized charges can catch problems early.

But the survey results suggest many Americans aren’t confident that personal precautions are enough. As banking moves almost entirely online, customers are betting their financial security on institutions they hope are doing more behind the scenes to stay ahead of threats.