A developer reported the scam after noticing a slight discrepancy in the email address. The scam passed Google’s own DKIM checks.

Etherem Name Service developer Nick Johnson received the same Google phishing scam and reported the attackers’ misuse of Google OAuth applications as a security bug to Google. The company initially brushed it off as “working as intended,” but then backtracked and is now working on a fix.

Developer Nick Johnson (via X) was the target of a complex phishing attack that sees scammers send real-looking emails from Google, slipping past Gmail security and appearing to be a signed email from Google. As noted by Johnson, it even appears as a legitimate security alert.