Researchers warn that attackers are abusing Google’s own notification infrastructure to deliver highly convincing phishing emails that bypass traditional email security controls, impacting over 3,000 organizations worldwide.
Observed in December 2025, the campaign marks an escalation in trusted-platform abuse, using legitimate services — not spoofed domains — to deliver malicious messages.
Attackers “… are increasingly abusing Google’s own applications and cloud infrastructure to deliver phishing emails that look legitimate, authenticate cleanly, and evade traditional security controls,” RavenMail researchers said in a blog post.
Inside the Google Tasks phishing campaign
Instead of spoofing Google, attackers exploited Google’s Application Integration service to generate legitimate Google notification emails.
These messages contained familiar action buttons such as View task and Mark complete, closely matching authentic Google Tasks workflows and making them difficult for users to distinguish from real system alerts. When recipients clicked the buttons, they were redirected to phishing pages hosted at storage[.]cloud[.]google[.]com.
Because the links resolved to a trusted Google-owned domain, URL reputation and domain-based filtering failed to flag the activity as suspicious.
The phishing pages themselves were carefully crafted to mirror Google Tasks with high fidelity, using authentic-looking UI elements, branded layouts, footer text, and professional formatting. This visual legitimacy reduced user suspicion and increased the likelihood of credential submission.
The emails also used authority cues such as All Employees, paired with urgency and minimal context, to prompt fast action without scrutiny.
With no malicious attachments, no external domains, and no authentication anomalies, traditional email security controls had little signal to detect. Researchers note this campaign reflects a broader trend toward trusted-platform abuse.
Similar attacks have leveraged Google Classroom, Google Forms, and AppSheet to harvest credentials by manipulating legitimate enterprise workflows.
When trusted platforms become attack vectors
This campaign underscores a growing shift toward living-off-the-land attacks within trusted enterprise platforms.
Rather than relying on overtly malicious infrastructure, attackers repurpose legitimate SaaS capabilities to deliver phishing and social engineering at scale.
Similar abuse has been observed on platforms such as Salesforce and Amazon SES, where built-in messaging and automation features are leveraged to deliver malicious messages while appearing operationally normal.
As SaaS ecosystems become more interconnected and deeply embedded in daily workflows, the attack surface is moving away from traditional infrastructure vulnerabilities and toward business logic, identity trust, and workflow assumptions.
This evolution challenges security teams to rethink detection and defense strategies, focusing less on where a message comes from and more on whether its behavior aligns with expected use.
Defending against trusted SaaS abuse
Campaigns like these blend seamlessly into everyday business workflows, making them difficult to detect using domain reputation or signature-based controls alone.
Defending against this shift requires deeper visibility into how trusted tools are being used — and misused — across the organization.
- Implement contextual email analysis to detect anomalous workflows, such as the use of task or collaboration tools for identity, HR, or compliance actions.
- Enforce workflow-level controls within SaaS platforms to restrict which services can send employee-facing requests or external notifications.
- Apply phishing-resistant authentication and conditional access policies to limit the impact of credential compromise, even when users interact with trusted platforms.
- Harden cloud storage and link-sharing policies to prevent unauthenticated access, credential harvesting, or unexpected redirects from trusted domains.
- Enable post-delivery email detection and retroactive response capabilities to identify and remediate malicious messages after initial delivery.
- Expand logging, identity threat detection, and incident response playbooks to specifically address abuse of legitimate SaaS services and trusted infrastructure.
These steps help detect anomalous workflows and limit blast radius.
Editor’s note: This article first appeared on our sister publication, eSecurityPlanet.com.
