Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign

Cybercriminals have exploited Google Cloud’s Application Integration feature to run a multi-stage phishing campaign, with attackers impersonating legitimate Google‑generated messages by distributing emails via the Send Email task. According to Check Point, the messages were sent from a legitimate-looking address, “noreply-application-integration@google[.]com”, to bypass traditional filters and appear trustworthy.

The emails mimic routine enterprise notifications, such as voicemail alerts or file access requests, in an effort to lower suspicion, while the attack chain redirects recipients through storage.cloud.google[.]com and googleusercontent[.]com before presenting a fake CAPTCHA and a fake Microsoft login page to steal credentials.

Check Point’s analysis notes the campaign involved 9,394 phishing emails aimed at around 3,200 customers over a 14-day period in December 2025, with targets across the US, Asia-Pacific, Europe, Canada and Latin America, and spans sectors including manufacturing, technology, financial and professional services. Google has since blocked the phishing activities abusing the email notification feature and said it is taking further steps to prevent misuse.