How to Purge Google and Start Over – Part 1

This is a first-person post describing a red-team engagement against a Google Workspace customer where the testers used CredSniper phishing and Google Calendar event injection to compromise accounts and bypass multi-factor authentication; Google’s SOC and the customer detected the activity, coordinated to suspend correlated accounts and revoke access, and the author outlines the operational impact, account disruptions, and concerns about opaque vendor de-platforming and pentest policy ambiguity.