{"success":true,"data":{"id":"google-docs-comment-mention-lure","label":"Google Docs comment phish — real @docs.google.com sender + @-mention + phishing language or external non-Google URL","description":"Email is sent from the real Google Docs comment notification address (comments-noreply@docs.google.com, drive-shares-noreply@google.com, or related Google infrastructure) — so all email auth passes — but the comment content contains phishing language (sign in to view, verify account, wire transfer required, callback number, seed phrase) OR a hyperlink pointing to a non-Google domain. Attackers create a Google account, add a comment on a document and @-mention the victim; Gmail delivers a real google-signed notification. CheckPoint, DarkReading, CyberSecurity Dive, and The Hacker News (Jan 2026) documented active campaigns abusing this trusted-sender vector.","tier":"danger","category":"other","isThin":false}}