Google and Cloud Services

Security researchers report that in a two‑week campaign in December 2025, attackers abused the legitimate Send Email feature inside Google Cloud Application Integration to send more than 9,000 phishing emails that appeared to come from authentic Google addresses, targeting roughly 3,200 organizations worldwide, including many in the U.S. The emails mimicked routine Google notifications like voicemail or document‑sharing alerts, routed victims through Google‑hosted URLs and a fake CAPTCHA to a counterfeit Microsoft login page that harvested credentials, while Google says it has blocked several such campaigns, added protections and emphasized that its core infrastructure was not breached.