All Gmail users at risk from clever replay attack

Malicious actors are abusing Google Sites and OAuth app notifications to host DKIM-authenticated-looking phishing pages that impersonate Google support and accounts pages; they register OAuth apps with phishing content as the app name, trigger legitimate DKIM-signed alerts from [email protected], and forward those messages unchanged to evade email authentication and lure victims into entering Google credentials.