Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Google SMTP Relay Service Abused for Sending Phishing Emails

Google SMTP Relay Service Abused for Sending Phishing Emails

Phishing actors abuse Google’s SMTP relay service to bypass email security products and successfully deliver malicious emails to targeted users.

According to a report from email security firm Avanan, there has been a sudden uptick in threat actors abusing Google’s SMTP relay service starting in April 2022.

The company has detected at least 30,000 emails in the first two weeks of April being distributed through this method.

Attack details

Google offers an SMTP (Simple Mail Transfer Protocol) relay service that can be used by Gmail and Google Workspace users to route outgoing emails.

Businesses use this service for various reasons, ranging from not having to manage an external mail server to using it for marketing emails, so their mail server does not get added to a block list.

Avanan states that threat actors can utilize Google’s SMTP relay service to spoof other Gmail tenants without being detected, as long as those domains do not have a DMARC policy configured with the ‘reject’ directive.

Also Read: 7 Client Data Protection Tips to Keep Customers Safe

Domain-based Message Authentication, Reporting & Conformance, or DMARC, is an email authentication protocol that allows domain owners to specify what should happen if an email is spoofing their domain.

To do this, domain owners create a special DMARC DNS record that includes a directive telling a mail server what to do. These directives are ‘none’ (do nothing with the spoofed email), ‘quarantine’ (place email in the spam folder), or ‘reject’ (do not accept email at all).

The new phishing campaigns use the ‘’ SMTP server, which is a trusted server and is thus commonly placed on allow lists by email gateways and spam filtering services.

For example, the following email, spotted by Avanan, appears as if it comes from, but it’s in reality from and passed through Google’s relay service.

Malicious email impersonating Trello
Malicious email impersonating Trello (Avanan)

As previously stated, these attacks only work if the impersonated entity has set its DMARC policy to “none,” which is not as uncommon as you may think. For example,,,,,, and have DMARC policies set to ‘none.’ 

Setting strict DMARC policies is a recommended security practice as it helps prevent threat actors from spoofing domains.

In Trello’s case, DMARC policy has been disabled due to using other security tools, making the impersonation possible.

The emails are likely bypassing spam detections because all Gmail tenants who use this relay likely set up SPF records that place Google’s SMTP relay service on the trusted sender list for their domain.

Also Read: 9 Policies for security procedures examples

When a threat actor spoofs a Gmail tenant’s domain, it passes the SPF record, and as DMARC is not set to ‘reject,’ it will be successfully delivered to the targeted user’s inbox.

While these threat actors are abusing Google’s relay service, Avanan says that any other relay service is succeptible to the same type of abuse.

Avanan says they reported this abuse to the Gmail team on April 23, 2022.

Bleeping Computer has contacted Google with further questions and if it’s planning to take additional measures against this abuse, and a spokesperson has told us the following:

We have built-in protections to stop this type of attack. This research speaks to why we recommend users across the ecosystem use the Domain-based Message Authentication, Reporting & Conformance (DMARC) protocol. Doing so will defend against this attack method, which is a well-known industry issue.

Details on how users can configure their environments appropriately can be found here: and here:

There’s nothing unique to Workspace here, it speaks to how email standards operate across the industry. This research doesn’t reflect many of the layered defenses which keep customers safe, such as DMARC and email abuse filtering.


Checking the sender’s address to spot a malicious spoofing attempt isn’t enough against this type of attack, so checking the full headers when you’re unsure would be an excellent place to start.

Additionally, when links are embedded in the message body, hover over them to check the destination instead of clicking. Sometimes, merely visiting harmful sites is enough for malware to be dropped on your system.

Finally, if the message contains any attachments, especially if these are of risky formats, do not download and do not open them.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us