Phishing campaign abuses Google Cloud Application to impersonate legitimate Google emails

Researchers uncovered a phishing campaign that abuses Google Cloud Application Integration to send emails impersonating legitimate Google messages, with the activity described by Check Point as a multi-stage effort designed to evade detection. The campaign sent nearly 9,400 emails to around 3,200 customers over a two-week period, using the legitimate Google address and a layered redirection chain to look trustworthy.

The messages mimicked Google's style and included common lures such as voicemail alerts or shared file access requests to prompt clicks, and were dispatched via Google Cloud’s Application Integration Send Email feature to mail from Google-owned domains without compromising Google's infrastructure.

The redirection path started at trusted storage.cloud.google[.]com, moved to googleusercontent[.]com where a fake CAPTCHA appeared to bypass scanners, and finally delivered users to a counterfeit Microsoft login page on a non-Microsoft domain to harvest credentials. The campaign primarily affected manufacturing and industrial firms, with notable activity in technology, SaaS, and finance, and most victims located in the United States, Asia-Pacific, and Europe, though smaller shares were reported in other regions.

Google's statement emphasises that the issue stemmed from abuse of a workflow automation tool, not a breach of Google’s infrastructure, and stresses continued caution as attackers often spoof trusted brands.