Phishing sent from Google's own infrastructure hit over 3,000 organisations

Check Point has uncovered a phishing campaign that abused Google Cloud Application Integration to send email from a genuine Google address, thereby passing traditional filters. Over two weeks, 9,394 malicious emails went out, styled as routine enterprise notifications. Recipients were led through several stages: first legitimate Google Cloud pages, then a fake CAPTCHA, and finally a fraudulent Microsoft login page that harvested credentials. The campaign hit organisations worldwide, with manufacturing and technology the most affected sectors ahead of finance and banking. Google states that its tools were abused rather than breached, and that the campaigns are blocked.

What this means for your organisation

The sender domain was real, and the first steps of the chain sat on Google's own pages. Controls built on sender and domain reputation have little to work with here. For industrial and technology firms this is a realistic scenario, and the outcome is a hijacked Microsoft account.

Berigo recommends

• Deploy phishing-resistant multi-factor authentication so a stolen credential does not grant access.
• Use conditional access requiring a known device for Microsoft 365.
• Teach staff that the sender address alone proves nothing, and that sign-in should start from a bookmark or portal.
• Monitor new sign-ins, forwarding rules and device registrations in the mail environment.

Source

• blog.checkpoint.com