App password created to sign in to your account

This phishing attack leveraged a Google apps security notification to show a scammer's custom phishing message to the recipient. The attack is designed to trick the recipient into thinking that their account was compromised, although no U-M account or system compromise occurred. The goal of the the scammer is to get the recipent to call the provided phone number so that the recipent can be scammed over the phone.

Clicking the legitimate Google account links lead to the recipient's own clean dashboard, providing zero information or resolution. This is an intentional dead end designed to confuse and concern the recipient, so that the recipient only has one actionable resolution left in the email: calling the scammer's phone number.

Technical Details

The attacker set a fake $399 McAfee invoice and support phone number as a Google App Password label, forcing Google’s systems to generate an authentic, signed security alert containing the scammer's phishing message. Google sent the alert to the scammer's recovery domain, which routed it through a compromised high school’s Microsoft 365 tenant to auto-forward to U-M. Stacking valid Microsoft and Google DKIM/DMARC signatures allowed the message to pass all gateway checks.