For the record, this is a Clem Meredith Headhunter phishing email attempt that is recently going around, with subject "Confidential Search for Principal Consultant, Enterprise Data Strategy within Financial Services"
What to do? Report them, go to bottom of page.
From: Clem Meredith <clemmeredith.bs@gmail.com>
Subject: Confidential Search for Principal Consultant, Enterprise Data Strategy within Financial Services
|
Phishing Link
1. https://confidential-mail.google.com/msg/ALxs4W7NZaIraMlILN5qzd_kLMssjUchAFPNppXaHZfnWx5ifRRNfUM4ukyRUKKRUbbJw2FnDm5A1vNXMsPHumZ5y-fcn08OBuiwjG9s_lBV1GSQ2k97WSBoMK3auZKf2-iq
Yes, the structure of this link is valid. It is an official URL format used by Google for Gmail's Confidential Mode.
When a user sends an email using Gmail Confidential Mode to a non-Gmail recipient (like an Outlook, Yahoo, or corporate email address), the email body is not sent directly. Instead, Google hosts the content on its own servers and replaces the message body with a link that points to confidential-mail.google.com.
Key Things to Know Before Clicking:
Verify the Sender: Since scammers frequently use Google services to mask phishing attempts, ensure you actually know and trust the person who sent you this email.
Identity Verification: When you click a valid link like this, Google will usually require you to log in with your recipient email or request a one-time SMS passcode (if the sender enabled it) to verify your identity before revealing the message.
Expiration: These links are temporary. Senders can set them to expire anywhere from 1 day to 5 years, or they can revoke access manually at any time. If it has expired, the link will no longer work.
Safety Tip: If you received this link in an unexpected email from an unknown sender, do not interact with it or provide any personal details, as it could be a phishing attempt designed to exploit Google's trusted domain.
How to tell this is a Phishing email?
- Check email address in full, if it's not from originating company then it's phishing.
- Hover over all links in email, if it's not from the company's website then forget it.
- The best way is to look at message source, see below.
Use an AI
Gemini Response: Yes, there is an incredibly high probability that this is a spear-phishing email.
Phishers frequently target senior independent consultants and technology executives with high-level recruitment lures because they match your specific professional background perfectly.
This specific combination contains several massive red flags:
1. The Abuse of "Gmail Confidential Mode"
Legitimate executive recruiters almost never use Gmail Confidential Mode for initial, cold outreach.
The Trap: Attackers love using real or highly realistic replicas of Gmail's Confidential Mode interface because it forces you to click a link to view the message or request a one-time passcode (OTP).
The Goal: Once you click, they typically redirect you to a highly convincing, fake Google login screen to steal your credentials, or they use a fake SMS verification page to intercept multi-factor authentication codes.
2. High-Value "Bait"
The subject line—Principal Consultant, Enterprise Data Strategy within Financial Services—is meticulously tailored to sound lucrative, exclusive, and highly relevant. By framing it as "Confidential," the attacker creates a false sense of urgency and privacy, attempting to trick you into dropping your guard or bypassing standard corporate security protocols.
3. Ghost Senders
"Clem Meredith" does not match any prominent or established executive search firms specializing in enterprise data or financial services technology recruitment. Attackers frequently genericize names or impersonate obscure, real people to blend into an inbox.
What to do next:
- Do not click any buttons like "View Email" or "Request Passcode."
- Do not reply to the message to ask if it's real; this just confirms to the attacker that your email address is active.
- Report it: Mark the email as "Report Phishing" directly within your Gmail interface so Google's automated filters can block the infrastructure behind it.
How to examine Email Message Source?
Now let's look at message source
- Outlook.com->Actions->View Message Source.
- Gmail.com->More (down arrow to top right)->Show original.
Check for suspicious links, anything that does not originate from source domain, like apple.com.
-------------------------------------------------------------------------------------------------------------
Report Phishing Email (not as Spam)
- Outlook.com->Junk (at Top)->Phishing Scam
- Gmail.com->More (down-arrow to top right)->Report Phishing
Report Phishing to Google
If you have received this email, take further action by
Report phishing at Microsoft and government agencies
- http://www.microsoft.com/security/online-privacy/phishing-faq.aspx
Report phishing for Web hosting companies (e.g., GoDaddy, Cloudflare, DigitalOcean) and ISPs
Anti‑Phishing Working Group (APWG) — forward to reportphishing@apwg.org
