Developer Nick Johnson (via X) was the target of a complex phishing attack that sees scammers send real-looking emails from Google, slipping past Gmail security and appearing to be a signed email from Google. As noted by Johnson, it even appears as a legitimate security alert.

Until Google rolls out a fix, you'll have to be on the lookout for this particularly convincing phishing scam.