Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services
ID: 0450ca9b-17dc-5a34-a7de-f8f79d689fbf
STIX ID: report--0450ca9b-17dc-5a34-a7de-f8f79d689fbf
Feed Name: Krebs on Security
Threat Score
**Google fixed an authentication bypass in Workspace account sign-up that let attackers circumvent email/domain verification to create Email Verified accounts and then use Google SSO to impersonate domain owners at third-party services.** The abuse, observed in late June and involving a few thousand accounts, enabled sign-ins to services such as Dropbox; Google remediated the flaw within 72 hours and added detection to prevent similar bypasses.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.