Percentage-based URL encoding plus Google domain trickery is helping malicious emails to evade filters.
Source: Threadpost