Cybercriminals used AI-assisted voice phishing and Google g.co domain to target Hack Club founder
Cybercriminals reportedly used AI-assisted voice phishing and spoofed caller ID alongside Google's g.co subdomain to attempt account takeover of Hack Club founder Zach Latta. Google suspended the Workspace account behind the scam and said it would strengthen defenses against abusive g.co sign-ups.
What happened
Cybercriminals used advanced voice phishing to target Zach Latta, founder of Hack Club. A caller claiming to be Google's Workspace team member named 'Chloe' with an American accent called from what appeared to be a legitimate Google number (650-203-0000) and displayed 'Google' as the caller ID, claiming there had been an unusual login attempt from Frankfurt.
The attackers sent a phishing email from a g.co subdomain claiming to be a password reset request from a legitimate Google address. The scammers later created a Google Workspace account using a g.co subdomain to generate deceptive emails via legitimate Google infrastructure, exploiting the trusted domain to appear credible.
During the call, a second scammer named 'Solomon' provided Latta with the genuine two-factor authentication number from his device and attempted to guide him to type it in a specific way, which raised his suspicions. Latta discovered inconsistencies in the scammers' story and avoided account compromise.
Reported impact
Latta described this as the most sophisticated phishing attempt he had encountered. The attack nearly compromised his account and demonstrated how cybercriminals could overcome typical security verification practices.
Index analysis
The incident involved AI-assisted techniques to make the phishing attack convincing, with the attacker speaking clearly and naturally. Cybercriminals used the legitimacy of Google's g.co domain and caller ID spoofing to increase credibility, exploiting standard user verification practices such as checking phone numbers and requesting emails from legitimate domains.
Governance controls
Google suspended the unverified Workspace account used in the scam. Google stated it had not seen evidence this was a wide-scale tactic but announced it was hardening defenses against abusers leveraging g.co references at sign-up.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.