When Google Sends the Phish: Abusing Legitimate Infrastructure and Sender Identity in a Live Vishing Attack

Vishing attacks targeting Google accounts have grown more sophisticated — not by breaking authentication systems, but by weaponizing them. This talk presents a forensic case study of a real, coordinated attack that combined display-name header spoofing with deliberate abuse of Google's account recovery notification infrastructure to deliver a fully authenticated, DKIM-signed Google security alert directly to the victim's inbox. The attack began with a phone call impersonating Google Support, followed by two precisely timed emails. The first was a spoofed phishing lure — appearing as "support@google" while originating from attacker-controlled infrastructure at case-priority.com, relayed through MailChannels and Hostinger, with SPF passing on the envelope sender while the visible From header pointed to a non-existent domain. The second required no spoofing at all: the attacker added the victim's address as a recovery contact on a throwaway Gmail account, then triggered account changes — causing Google's own servers to send a legitimate security alert to the victim's inbox. The contrast between the two emails is forensically significant and operationally underappreciated. Attendees will learn to identify SPF alignment failure behind a passing SPF result, read SMTP relay chains to surface attacker infrastructure, and distinguish display-name spoofing from envelope spoofing in raw headers. The talk concludes with a MITRE ATT&CK mapping of the full attack chain, header-level IOCs, and hardening recommendations for Google Workspace environments that DFIR practitioners can implement immediately.