Hackers Impersonate Google AppSheet in Latest Phishing Campaign

Hackers are exploiting Google’s AppSheet no‑code platform to harvest user credentials by abusing its trusted mail infrastructure and delivering malicious content from legitimate domains. The campaign targeted Google Workspace–centric organisations with AppSheet‑branded emails, using a look‑alike Google URL shortener to drive recipients to credential‑harvesting pages.

Attackers deployed three main abuse scenarios: hijacking genuine AppSheet accounts to embed malicious links in authentic templates, creating new AppSheet accounts to misuse notification systems and form builders for distribution, and injecting rogue URLs into user‑generated templates to send phishing messages at scale.

The effort builds on a trend first observed in March 2025, when AppSheet‑based phishing peaked on 20 April 2025, accounting for 10.88% of global phishing email volume, with nearly all impersonations targeting Meta and only a small fraction targeting PayPal. Raven AI’s context‑aware engine is described as detecting anomalies in message content and intent, highlighting that traditional defenses focused on sender reputation can fail when attackers misuse legitimate infrastructure. The piece argues for context‑driven, behaviour‑oriented detection that evaluates content and usage norms alongside authentication checks.