Cybersecurity researchers have disclosed particulars of a phishing marketing campaign that includes the attackers impersonating respectable Google-generated messages by abusing Google Cloud’s Software Integration service to distribute emails.
The exercise, Verify Level stated, takes benefit of the belief related to Google Cloud infrastructure to ship the messages from a respectable e-mail deal with (“noreply-application-integration@google[.]com”) in order that they will bypass conventional e-mail safety filters and have a greater probability of touchdown in customers’ inboxes.
“The emails mimic routine enterprise notifications equivalent to voicemail alerts and file entry or permission requests, making them seem regular and reliable to recipients,” the cybersecurity firm stated.
Attackers have been noticed sending 9,394 phishing emails focusing on roughly 3,200 clients over a 14-day interval noticed in December 2025, with the affected organizations situated within the U.S., Asia-Pacific, Europe, Canada, and Latin America.
On the coronary heart of the marketing campaign is the abuse of Software Integration’s “Ship Electronic mail” job, which permits customers to ship customized e-mail notifications from an integration. Google notes in its assist documentation that solely a most of 30 recipients might be added to the duty.
The truth that these emails might be configured to be despatched to any arbitrary e-mail addresses demonstrates the risk actor’s skill to misuse a respectable automation functionality to their benefit and ship emails from Google-owned domains, successfully bypassing DMARC and SPF checks.
“To additional improve belief, the emails carefully adopted Google notification type and construction, together with acquainted formatting and language,” Verify Level stated. “The lures generally referenced voicemail messages or claims that the recipient had been granted entry to a shared file or doc, equivalent to entry to a ‘This fall’ file, prompting recipients to click on embedded hyperlinks and take quick motion.”
The assault chain is a multi-stage redirection circulate that commences when an e-mail recipient clicks on a hyperlink hosted on storage.cloud.google[.]com, one other trusted Google Cloud service. The hassle is seen as one other effort to decrease consumer suspicion and provides it a veneer of legitimacy.
The hyperlink then redirects the consumer to content material served from googleusercontent[.]com, presenting them with a faux CAPTCHA or image-based verification that acts as a barrier by blocking automated scanners and safety instruments from scrutinizing the assault infrastructure, whereas permitting actual customers to cross by.
As soon as the validation section is full, the consumer is taken to a faux Microsoft login web page that is hosted on a non-Microsoft area, finally stealing any credentials entered by the victims.
In response to the findings, Google has blocked the phishing efforts that abuse the e-mail notification characteristic inside Google Cloud Software Integration, including that it is taking extra steps to forestall additional misuse.
Verify Level’s evaluation has revealed that the marketing campaign has primarily focused manufacturing, expertise, monetary, skilled companies, and retail sectors, though different business verticals, together with media, training, healthcare, power, authorities, journey, and transportation, have been singled out.
“These sectors generally depend on automated notifications, shared paperwork, and permission-based workflows, making Google-branded alerts particularly convincing,” it added. “This marketing campaign highlights how attackers can misuse respectable cloud automation and workflow options to distribute phishing at scale with out conventional spoofing.”
‘
Replace
Each xorlab and Ravenmail have disclosed particulars of the credential harvesting marketing campaign, with the previous noting that the assaults are additionally getting used to hold out OAuth consent phishing, in addition to host the faux login pages on Amazon Internet Companies (AWS) S3 buckets.
“The attackers trick victims into granting a malicious Azure AD utility entry to their cloud assets – getting access to Azure subscriptions, VMs, storage, and databases through delegated permissions that persist by entry and refresh tokens,” xorlab stated.
“Every hop makes use of trusted infrastructure – Google, Microsoft, AWS – making the assault troublesome to detect or block at any single level. Whatever the entry level, victims finally land on the Microsoft 365 login web page, revealing the attackers’ main goal: M365 credentials.”
