Cybersecurity researchers have disclosed particulars of a phishing marketing campaign that includes the attackers impersonating reputable Google-generated messages by abusing Google Cloud’s Software Integration service to distribute emails.
The exercise, Verify Level stated, takes benefit of the belief related to Google Cloud infrastructure to ship the messages from a reputable e mail deal with (“noreply-application-integration@google[.]com”) in order that they will bypass conventional e mail safety filters and have a greater likelihood of touchdown in customers’ inboxes.
“The emails mimic routine enterprise notifications reminiscent of voicemail alerts and file entry or permission requests, making them seem regular and reliable to recipients,” the cybersecurity firm stated.
Attackers have been noticed sending 9,394 phishing emails concentrating on roughly 3,200 clients over a 14-day interval noticed in December 2025, with the affected organizations positioned within the U.S., Asia-Pacific, Europe, Canada, and Latin America.
On the coronary heart of the marketing campaign is the abuse of Software Integration’s “Ship Electronic mail” job, which permits customers to ship customized e mail notifications from an integration. Google notes in its assist documentation that solely a most of 30 recipients may be added to the duty.
The truth that these emails may be configured to be despatched to any arbitrary e mail addresses demonstrates the risk actor’s capacity to misuse a reputable automation functionality to their benefit and ship emails from Google-owned domains, successfully bypassing DMARC and SPF checks.
“To additional improve belief, the emails intently adopted Google notification type and construction, together with acquainted formatting and language,” Verify Level stated. “The lures generally referenced voicemail messages or claims that the recipient had been granted entry to a shared file or doc, reminiscent of entry to a ‘This fall’ file, prompting recipients to click on embedded hyperlinks and take quick motion.”
The assault chain is a multi-stage redirection circulation that commences when an e mail recipient clicks on a hyperlink hosted on storage.cloud.google[.]com, one other trusted Google Cloud service. The hassle is seen as one other effort to decrease person suspicion and provides it a veneer of legitimacy.
The hyperlink then redirects the person to content material served from googleusercontent[.]com, presenting them with a pretend CAPTCHA or image-based verification that acts as a barrier by blocking automated scanners and safety instruments from scrutinizing the assault infrastructure, whereas permitting actual customers to cross by means of.
As soon as the validation part is full, the person is taken to a pretend Microsoft login web page that is hosted on a non-Microsoft area, in the end stealing any credentials entered by the victims.
In response to the findings, Google has blocked the phishing efforts that abuse the e-mail notification characteristic inside Google Cloud Software Integration, including that it is taking extra steps to forestall additional misuse.
Verify Level’s evaluation has revealed that the marketing campaign has primarily focused manufacturing, expertise, monetary, skilled providers, and retail sectors, though different trade verticals, together with media, training, healthcare, power, authorities, journey, and transportation, have been singled out.
“These sectors generally depend on automated notifications, shared paperwork, and permission-based workflows, making Google-branded alerts particularly convincing,” it added. “This marketing campaign highlights how attackers can misuse reputable cloud automation and workflow options to distribute phishing at scale with out conventional spoofing.”
