G
Sophisticated Google Workspace and Gmail "Security Alert" phishing designed to bypass MFA and take over corporate accounts.
Official indicators
G
Google<no-reply@accounts.google.com>
To: you@example.com
For your security, please Review Google Security Activity to complete this action.
Original URL: https://myaccount.google.com/security. Click or tap if you trust this link.
What real Google messages look like
- Security alerts come strictly from @accounts.google.com
- Google will never ask for your password, 2FA codes, or recovery keys in an email
- Official security status can always be verified at myaccount.google.com/security
- Google Workspace admins will only communicate via verified organisational channels
Common spoof patterns
- "Someone has your password" fake security alerts leading to a malicious login page
- "Critical security alert: New sign-in detected" lures harvesting credentials
- "Storage full" or "Account suspended" phishing intended to create panic