Cybersecurity researchers have revealed details of a phishing campaign involving attackers impersonating legitimate messages generated by Google, abusing Application Integration to distribute emails.
See also: 27 malicious npm packages used as Phishing infrastructure
This activity exploits the trust associated with Google Cloud infrastructure to send messages from a legitimate email address (“noreply-application-integration@google.com”), allowing them to bypass traditional email security filters and have a greater chance of reaching users’ inboxes.
The emails mimic common business notifications, such as voicemail notifications and requests for access or permissions for files, making them appear normal and trustworthy to recipients.
Attackers were observed sending 9,394 phishing emails targeting approximately 3,200 customers during a 14-day period observed in December 2025, with affected organizations located in the U.S., Asia-Pacific, Europe, Canada, and Latin America.
At the heart of the campaign is the abuse of “Send Email” task , which allows users to send custom email notifications from an integration. Google notes in its support documentation that only a maximum of 30 recipients can be added to the task.
The fact that these emails can be configured to be sent to arbitrary email addresses demonstrates the attacker's ability to abuse a legitimate automation feature to their advantage and send emails from domains owned by Google, effectively bypassing DMARC and SPF.
See also: OAuth device code phishing: New technique for compromising Microsoft 365 accounts
To further build trust, the emails closely followed the style and structure of Google notifications, including familiar formatting and language. The decoys often referred to voicemail messages or claimed that the recipient had gained access to a shared file or document, urging recipients to click on embedded links and take immediate action.
The attack chain is a multi-layered redirect flow that begins when an email recipient clicks on a link hosted on storage.cloud.google.com, another trusted Google Cloud service. This effort aims to reduce user suspicion and add an appearance of legitimacy.
The link then redirects the user to content served by googleusercontent.com, presenting them with a fake CAPTCHA or image-based verification that acts as a barrier, preventing automated scanners and security tools from examining the attack infrastructure while allowing real users to pass through.
Once the verification phase is complete, the user is taken to a fake Microsoft login page hosted on a non-Microsoft domain, ultimately stealing any credentials entered by the victims.
In response to the findings, Google has blocked phishing attempts that abuse the email notification feature within Google Cloud Application Integration, adding that it is taking more measures to prevent further abuse.
The analysis revealed that the campaign primarily targets the industrial, technology, financial, professional services, and retail sectors, although other sectors, including media, education, healthcare, energy, government, travel, and transportation, have also been affected.
See also: APT28 targets UKR.net users in Ukraine in long-running phishing campaign
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
These domains typically rely on automated notifications, shared documents, and permission-based workflows, making Google-branded alerts particularly persuasive. This campaign highlights how attackers can abuse legitimate cloud automation and workflow capabilities to distribute phishing at scale without traditional spoofing.
