SUPER nasty google account scam mail i just got! It's all from official google senders etc, but attackers can apparently just put a whole message and url in the title field of an app password, using *official google* emails to send you to scam sites!
"login here" was a hard tell though, but still!