In a world where digital communication is paramount, the sophistication of phishing attacks has reached unsettling heights. One such technique—DKIM Replay Attack—has recently been used to spoof emails that appear to come directly from Google. In this blog post, we'll break down the mechanics of this attack, how it leverages legitimate infrastructure for malicious purposes, and what steps you can take to protect yourself and your organisation.

What Is a DKIM Replay Attack? DomainKeys Identified Mail (DKIM) is an email authentication method designed to detect forged sender addresses in emails. In a DKIM Replay Attack, threat actors exploit previously signed legitimate emails and resend them with malicious intent, bypassing traditional security filters due to the email’s valid DKIM signature.

👾How the Attack Works

Creating the Trap: The attacker creates a malicious Google OAuth application and embeds a phishing message in the app's name field.

Triggering a Legitimate Email: When the attacker grants the app access to their Google Account, Google sends a genuine security alert email.

Replay and Redirect: This valid email, now containing a phishing message, is forwarded to potential victims. Since it retains a valid DKIM signature, it often bypasses spam filters and appears trustworthy.

Phishing Page Hosted on Google Sites: The email typically contains a link to a Google Sites page that mimics a real Google support portal. Once users click the link and input their credentials, they’re captured by the attackers.

👨‍🔧Why This Is So Effective

• It comes from a Google domain (no-reply@google.com), increasing trust.
• It passes DKIM checks, giving it legitimacy in the eyes of security systems.
• It uses Google Sites, which hosts the phishing content under a trusted subdomain.

👀Warning Signs to Look For

• Unsolicited security notifications or legal requests from Google.
• Google Sites links that prompt for login credentials.
• Urgent language pushing immediate action.

👨‍✈️How to Protect Yourself

• Enable Two-Factor Authentication (2FA): Adds an additional layer of security beyond your password.
• Use Email Security Solutions: Deploy tools that analyse more than just DKIM signatures.
• Train Your Teams: Security awareness is your first line of defence. Educate users about modern phishing tactics.
• Always verify URLS: Official Google login pages begin with "https://accounts.google.com".
• Report Suspicious Emails: If in doubt, report the email to your IT or security team.

Conclusion🧳: DKIM Replay Attacks highlight the evolving complexity of phishing scams. Even trusted platforms can be misused by attackers in clever ways. The key to staying safe is awareness, verification, and adopting strong cybersecurity hygiene.

Stay alert, stay educated, and share this knowledge to protect others in your network.

✍🏻Sources,

• https://easydmarc.com/blog/google-spoofed-via-dkim-replay-attack-a-technical-breakdown/
• https://threadreaderapp.com/thread/1912439023982834120.html#google_vignette
• https://www.theverge.com/news/652509/google-no-reply-dkim-phishing-scam
• https://thehackernews.com/2025/04/phishers-exploit-google-sites-and-dkim.html?m=1

#CyberSecurity #DKIMReplay #PhishingAwareness #GoogleSpoofing #InfoSec