Cybercriminals Misuse Google Cloud Feature in a New Large-Scale Phishing Attack

Cybersecurity researchers just found a new phishing attack, and honestly, it’s pretty scary. This time, cybercriminals are twisting a real Google Cloud feature for their own use.

What Actually Happened?

A feature of Google Cloud was misused. Google Cloud has a feature named “Application Integration. Typically, companies use these to send automated emails – for things like order confirmation, system alerts, or workflow notifications. But attackers misused this feature. 

The scammers sent out emails that looked like everyday stuff, voicemail alerts, shared files, nothing out of the ordinary. When people clicked the link, it sent them to a real Google Cloud storage page. That alone made the whole thing feel legit.

But from there, things got sneaky. The link bounced users to a fake CAPTCHA, just another trick to keep them guessing. Then, finally, it landed them on a phony Microsoft login page sitting on a shady website. Anyone who typed in their username and password handed it straight to the attackers.

Scale of the Attack

About 9,300 phishing emails were sent in the last two weeks of December 2025. Their targets were approximately 3,200 different organizations. Clearly, every company must have received many false emails.

This attack did not happen suddenly. Everything was well thought out and planned on a large scale. It was not limited to just one country; the attackers covered the entire world. America, Asia-Pacific, Europe, Canada, Latin America, these emails reached everywhere.

Overall, the aim of the attackers was to reach as many people as possible and create victims at the international level.

But why do these emails seem so convincing?

Well, the sender address looks like it’s from Google. The email itself feels professional, with Google’s branding and the kind of language you’d expect from a company like that. People see it and just assume it’s from Google or another trusted company.

What’s inside these emails?

You receive fake alerts, such as “account issue,” “security warning,” or “payment problem.” There are malicious links, and sometimes there’s a login page that looks exactly like the real thing. Once someone clicks the link and enters their email and password, boom, the attackers grab their login details.

What did Google do?

Google also confirmed that there was misuse of the Application Integration email feature, and it has now blocked it.

This simply means that attackers can no longer send phishing emails using this feature.

Google did not end the discussion here. Now it has also brought extra security controls, so that anyone moving forward does not misuse this feature again. Meaning, there is no scam in the name of Google again.

But users will still have to remain alert. Google itself said that it is not enough to rely only on it. Users will also have to be careful themselves, because attackers are looking for them in many ways. Today it is Google Cloud, tomorrow it could be any other trusted platform.

Found this article interesting? Explore more ransomware security insights and threat updates.