Casa co-founder Jameson Lopp has warned about a phishing campaign that delivers fake emails through Google's own systems, abusing the company's infrastructure to make the messages look genuine.

Cryptocurrency holders face the greatest risk from the scheme, which relies on counterfeit login pages designed to steal passwords and other sensitive data.

A scam email sent from Google itself

In a post on X published on Thursday, Lopp said the campaign is a new version of an old scam that is currently running. He attached a screenshot of the fraudulent email, showing that it was sent through Google's actual servers.

New flavor of Google phishing that abuses Google's own infrastructure to send you this email. If you click the link you end up at a phishing login page. pic.twitter.com/dfkvfibo33

— Jameson Lopp (@lopp) October 29, 2026

According to the post, anyone who clicks the link inside the message is taken to a phishing login page.

This is not the first time Lopp has flagged abuse of Google's systems. In May, he highlighted a scam that misused Google's account recovery form, in which the attacker entered a very long message into the form, keeping a notice that looked authentic at the top and placing the scam link far below it, after a large stretch of empty space. The alert in the current incident likewise arrived through Google's real account systems. Taken together, the episodes show attackers repeatedly routing scams through legitimate Google features rather than forging the company's identity, which blunts the most common way recipients judge whether an email is real.

Check Point documented a similar campaign

Security firm Check Point (NASDAQ: CHKP) uncovered a campaign that misused the "Send Email" feature in Google Cloud's Application Integration tool. Over a period of two weeks in December 2025, attackers sent 9,394 emails to roughly 3,200 organizations. Because the messages came from a genuine Google address, noreply-application-integration@google.com, they passed DMARC and SPF checks, which normally signal to receiving mail servers that a message is authentic. DMARC and SPF are the industry-standard protocols mail providers use to confirm that a message genuinely comes from the domain shown in its sender address, so a clean pass on both carries significant weight with spam filters and recipients alike.

Recipients who clicked the links were first routed through several trusted Google web addresses. They then encountered a fake CAPTCHA page designed to stop automated security scanners, before landing on a fake Microsoft (NASDAQ: MSFT) login page that was not hosted by Microsoft.

Google (NASDAQ: GOOGL) told researchers it had blocked the campaigns, saying the problem stemmed from misuse of an automation tool rather than a break-in to its systems. Similar scams have reportedly been carried out through Google Meet, DoubleClick, Google Analytics and other services. The recurring pattern means a message can look legitimate on every technical signal and still lead to a hostile page, even though Google maintains its own systems were not breached.

Why crypto holders are targeted so often

Users of cryptocurrency exchanges and wallet holders are considered especially exposed, because fake login pages can be used to capture passwords, session data or two-factor authentication codes. The stakes are also structurally higher than in traditional finance: a fraudulent transfer of crypto funds is generally irreversible once confirmed on-chain, leaving little room for recovery after credentials are stolen.

The warning follows a separate incident reported by Cryptopolitan this week, in which scammers used leaked API keys from Cloudflare (NYSE: NET) to send emails from Foundation's own domains. Some recipients said the messages they received contained legitimate personal details, including their names, addresses and past Passport purchases. Foundation has since revoked the keys and said that funds on its devices are safe.

More broadly, Binance said it blocked 22.9 million scam and phishing attempts in the first quarter of 2026, a 54% increase over the previous quarter, and that it protected about $1.98 billion in user funds — a pace that indicates phishing remains one of the industry's most persistent attack vectors even as individual campaigns get shut down.