Phishing Campaign Abuses Google’s Infrastructure to Bypass Defenses

Researchers at RavenMail report a widespread phishing campaign that targeted more than 3,000 organizations—mostly in the manufacturing sector—by using legitimate Google infrastructure (Google Cloud Storage, Google Forms/Classroom and Google-hosted URLs) to host credential-harvesting pages and multi-stage redirects. Because the emails originated via trusted Google services and passed SPF/DKIM/DMARC, they frequently bypassed secure email gateways and native email protections; RavenMail notes attackers manipulated workflow automation rather than breaching Google systems.