Fake Google Security Alert Hides a Phishing Scam

**Phishing via Google OAuth and Sites:** Threat actors abused Google OAuth app names and Google Sites hosting to produce convincing spoofed emails that passed DKIM checks and impersonated google.com (e.g., fake subpoena alerts), directing victims to credential-harvesting pages; Google confirmed awareness and is working on a fix. The report also notes other OAuth misuses, including resurrected employee addresses and PayPal alert scams.