A developer reported the scam after noticing a slight discrepancy in the email address. The scam passed Google’s own DKIM checks.

Developer Nick Johnson (via X) was the target of a complex phishing attack that sees scammers send real-looking emails from Google, slipping past Gmail security and appearing to be a signed email from Google. As noted by Johnson, it even appears as a legitimate security alert.