Trusted Google Notifications Used in Phishing Campaign Targeting 3,000+ Orgs

Researchers observed a widespread phishing campaign (Dec 2025) abusing Google Tasks and Application Integration to send authentic-looking notification emails that redirected users to credential-harvesting pages hosted on storage.cloud.google.com, impacting over 3,000 organizations. The report highlights the trend of trusted-platform abuse to evade domain- and reputation-based defenses and recommends contextual email analysis, tightened SaaS workflow controls, phishing-resistant authentication, hardened cloud-storage/link-sharing policies, and improved logging and incident response.