Cybercriminals Reportedly Exploited Google’s G.Co Subdomain and Spoofed Caller ID in AI-Driven Phishing Attack on Hack Club Founder

In January 2025, sophisticated AI-powered phishing attacks targeted Gmail users, with scammers using advanced voice synthesis technology to impersonate Google support representatives. The attackers called from legitimate Google phone numbers (650-203-0000) with 'Google' caller IDs and spoke with realistic American accents over clear connections. They claimed users' accounts had been compromised from unusual locations like Frankfurt and requested password resets. When victims requested email verification, the scammers sent emails from legitimate Google domains including workspace-noreply@google.com and exploited the g.co subdomain system. The scammers created unverified Google Workspace accounts using g.co subdomains, allowing them to send authentic-looking password reset emails through Google's infrastructure. Zach Latta, founder of Hack Club, nearly fell victim to this attack but became suspicious when inconsistencies emerged during the call. The scammers were able to provide genuine 2FA codes and guide victims through account recovery processes. Google confirmed they suspended the accounts behind these scams and stated they are hardening defenses against abusers leveraging g.co references. Similar attacks have also targeted Apple users, with the incidents serving as examples of how AI technology is being weaponized for increasingly sophisticated social engineering attacks.