The Email Came From Google. The Law Firm Did Not.

On March 27, 2026, attackers created a Google Workspace account to send a legitimate Google Drive share notification that visually impersonated Alston & Bird LLP using Cyrillic and small-cap Unicode homoglyphs; authentication (SPF/DKIM/DMARC) passed because Google sent the notification, but replies were routed to an attacker-controlled domain registered one day earlier. IRONSCALES detected the deception via Unicode display-name analysis and Reply‑To domain age and quarantined three mailboxes before any recipient clicked.