Google is rolling out its next big AI upgrade for Gmail, and while it comes with exciting advancements, it also raises serious privacy concerns. On top of that, a long-hidden cyber threat has finally come to light—one that could put billions of users at risk.
The Good News: Stricter Spam Filters Are Working
Let’s start with the positive. Google’s stricter spam email policies are making a noticeable impact, significantly cutting down the number of unwanted marketing emails flooding inboxes. According to MarTech, email engagement rates—such as open and click rates—have dropped considerably, and most marketing emails now end up in spam unless recipients actively engage with them.
For businesses, this is a nightmare. Many brands are facing major challenges in reaching their audiences, even when following best practices. But for regular users, this is a welcome change—fewer annoying promotional emails and a cleaner inbox.
However, marketers are already working on ways to bypass these restrictions. MarTech notes that email deliverability is more of an art than a science, and businesses are actively testing new strategies to avoid spam filters. In other words, this battle is far from over.
The Privacy Trade-Off: AI Reads Your Emails?
While Google’s AI-powered enhancements aim to improve the user experience, they come at a cost. Many users are uncomfortable with the idea of AI analyzing their personal emails. Despite Google’s assurances that users have control over their data and privacy settings, the thought of AI reading emails has left many feeling uneasy.
Google insists that privacy remains a top priority, and users can manage AI-powered features in their settings. But with Gmail dominating the email market in the U.S., these changes affect a vast number of people—whether they like it or not.
The Bad News: A Sophisticated Email Attack Has Been Hiding for Years
While Gmail’s security improvements are making an impact, cybercriminals continue to evolve their tactics. Security researchers at Infoblox have uncovered a highly sophisticated phishing attack that has been operating undetected for years. This attack uses a DNS trick to serve fake login pages for over 100 brands, including Gmail, Outlook, Yahoo, DHL, and even major banks.
The technique, dubbed “Morphing Meerkat” by Bleeping Computer, leverages DNS mail exchange (MX) records to dynamically generate phishing pages that appear legitimate. Attackers then use compromised WordPress sites, URL shorteners, and adtech infrastructure to distribute phishing links. What’s worse, after stealing a user’s credentials, the attack redirects them to the actual login page, making them think they simply mistyped their password.
How to Stay Safe
This attack highlights a growing issue: passwords alone are no longer enough to secure accounts. While two-factor authentication (2FA) adds an extra layer of protection, some forms of 2FA can still be exploited. Google recommends enabling passkeys and using the strongest available authentication methods to protect your account.
Cybercriminals are also leveraging open redirects in Google’s DoubleClick ad network to disguise phishing links. Stolen credentials are then distributed through various channels, including Telegram. The fact that this operation remained hidden for so long shows just how sophisticated modern cyber threats have become.
The Bottom Line
Email security is improving, but so are cybercriminal tactics. Google's AI-powered Gmail updates come with both benefits and risks—better spam protection but potential privacy concerns. Meanwhile, a stealthy phishing attack serves as a reminder that users must stay vigilant.
To stay safe, avoid clicking on suspicious links, enable the strongest security measures on your accounts, and remember: when it comes to cybersecurity, caution is always better than regret.
