Wednesday , June 4 2025
number

Hackers leverage Google’s subdomains, phone number to attack victims

Scammers called a victim using Google’s official support number and sent an email from an official subdomain. It’s unclear how they managed to use Google’s services. Software engineer Zach Latta, founder of Hack Club, reported a unique attack on GitHub.

https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4

Chloe called Latta from 650-203-0000, identified as “Google.” According to Google’s support page, this number is used by Google Assistant for automated calls like booking appointments or checking restaurant wait times.

New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

In March 2025, the Threatfabric mobile Threat Intelligence team identified Crocodilus, a new Android banking Trojan designed for device takeover....
Read More
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Qualcomm has issued security patches for three zero-day vulnerabilities in the Adreno GPU driver, affecting many chipsets that are being...
Read More
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Critical RCE Flaw Patched in Roundcube Webmail

Roundcube Webmail has fixed a critical security flaw that could enable remote code execution after authentication. Disclosed by security researcher...
Read More
Critical RCE Flaw Patched in Roundcube Webmail

Hacker claim Leak of Deloitte Source Code & GitHub Credentials

A hacker known as "303" claim to breach the company's systems and leaked sensitive internal data on a dark web...
Read More
Hacker claim Leak of Deloitte Source Code & GitHub Credentials

CISA Issued Guidance for SIEM and SOAR Implementation

CISA and ACSC issued new guidance this week on how to procure, implement, and maintain SIEM and SOAR platforms. SIEM...
Read More
CISA Issued Guidance for SIEM and SOAR Implementation

Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

The Qualys Threat Research Unit (TRU) found two local information-disclosure vulnerabilities in Apport and systemd-coredump. Both issues are race-condition vulnerabilities....
Read More
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

Australia enacts mandatory ransomware payment reporting

New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of...
Read More
Australia enacts mandatory ransomware payment reporting

Why Govt Demands Foreign CCTV Firms to Submit Source Code?

Global makers of surveillance gear have clashed with Indian regulators in recent weeks over contentious new security rules that require...
Read More
Why Govt Demands Foreign CCTV Firms to Submit Source Code?

CVE-2023-39780
Botnet hacks thousands of ASUS routers

GreyNoise has discovered a campaign where attackers have gained unauthorized access to thousands of internet-exposed ASUS routers. This seems to...
Read More
CVE-2023-39780  Botnet hacks thousands of ASUS routers

Bangladesh Bank instructed using AI to prevent online gambling

The rise of online gambling in the country is leading to increased crime and societal issues. In response, the central...
Read More
Bangladesh Bank instructed using AI to prevent online gambling
https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4

“She sounded like a real engineer, the connection was super clear, and she had an American accent,” the developer said.

https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4

Scammers pretending to be Google Workspace support warned Latta that they had blocked her account after unauthorized access from Frankfurt.

Latta suspected a scam and requested email confirmation.

https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4

Hackers surprisingly agreed and sent an email from a legitimate Google subdomain, g.co. The email looked authentic, with no signs of spoofing, and it successfully passed DKIM, SPF, and DMARC authentication checks. Latta shared the evidence in a post.

According to Google, g.co is an official URL shortcut that is “just for Google websites.”

“You can trust that it will always take you to a Google product or service,” the landing page for the domain reads.

Scammers suggested that the account may have been hacked via a Chrome extension and used fake LinkedIn accounts to falsely claim they worked at Google.

“Chloe” tried to trick the developer into taping one of the three numbers that popped up on his phone to “reset the account.” In reality, this action would have given scammers access to the account if performed.

The software engineer recorded the conversation when he suspected it was a phishing attempt.

“The thing that’s crazy is that if I followed the two ‘best practices’ of verifying the phone number + getting them to send an email to you from a legit domain, I would have been compromised,” Latta warns.

Google has not yet publicly addressed this specific issue.

Users should be careful with suspicious calls or emails and report any suspicious activity to Google’s security team.

Source: Cybernews, GitHub

Check Also

Google

Google patched 2 Android zero-days and 60 other flaws

In its April 2025 security update, Google patched 62 vulnerabilities in Android, including two zero-days …

Leave a Reply

Your email address will not be published. Required fields are marked *