Hackers Abusing Google Tasks Notification for Sophisticated Phishing Attack

A December 2025 phishing campaign leveraged Google’s Application Integration service and Google Cloud Storage to send legitimate-appearing Google Tasks notifications to more than 3,000 organizations (mainly manufacturing). Messages came from a legitimate Google address, passed email authentication (SPF/DKIM/DMARC/CompAuth), and redirected recipients to credential-harvesting pages hosted on storage.cloud.google.com, allowing attackers to bypass conventional email security that relies on sender reputation and domain trust.