Google Tasks Used to Deliver Stealth Phishing Attacks 

Researchers warn attackers are abusing Google’s own notification infrastructure to deliver highly convincing phishing emails that bypass traditional email security controls, impacting over 3,000 organizations worldwide. 

Observed in December 2025, the campaign marks an escalation in trusted-platform abuse, using legitimate services — not spoofed domains — to deliver malicious messages.

Attackers “… are increasingly abusing Google’s own applications and cloud infrastructure to deliver phishing emails that look legitimate, authenticate cleanly, and evade traditional security controls,” said RavenMail researchers.

Inside the Google Tasks Phishing Campaign

Instead of spoofing Google, attackers exploited Google’s Application Integration service to generate legitimate Google notification emails. 

These messages contained familiar action buttons such as View task and Mark complete, closely matching authentic Google Tasks workflows and making them difficult for users to distinguish from real system alerts.

When recipients clicked the buttons, they were redirected to phishing pages hosted at storage[.]cloud[.]google[.]com. 

Because the links resolved to a trusted Google-owned domain, URL reputation and domain-based filtering failed to flag the activity as suspicious.

The phishing pages themselves were carefully crafted to mirror Google Tasks with high fidelity, using authentic-looking UI elements, branded layouts, footer text, and professional formatting. 

This visual legitimacy may have reduced user suspicion and increased the likelihood of credential submission.

The emails also used authority cues such as All Employees, paired with urgency and minimal context, to prompt fast action without scrutiny. 

With no malicious attachments, no external domains, and no authentication anomalies, traditional email security controls had little signal to detect.

Researchers note this campaign reflects a broader trend toward trusted-platform abuse. 

Similar attacks have leveraged Google Classroom, Google Forms, and AppSheet to harvest credentials by manipulating legitimate enterprise workflows.

Defending Against Trusted SaaS Abuse

Campaigns like these blend seamlessly into normal business workflows, making them difficult to detect using domain reputation or signature-based controls alone. 

Defending against this shift requires deeper visibility into how trusted tools are being used — and misused — across the organization.

• Implement contextual email analysis to detect anomalous workflows, such as task or collaboration tools being used for identity, HR, or compliance actions.
• Enforce workflow-level controls within SaaS platforms to restrict which services are permitted to send employee-facing requests or external notifications.
• Apply phishing-resistant authentication and conditional access policies to limit the impact of credential compromise, even when users interact with trusted platforms.
• Harden cloud storage and link-sharing policies to prevent unauthenticated access, credential harvesting, or unexpected redirects from trusted domains.
• Enable post-delivery email detection and retroactive response capabilities to identify and remediate malicious messages after initial delivery.
• Expand logging, identity threat detection, and incident response playbooks to specifically address abuse of legitimate SaaS services and trusted infrastructure.

These steps help detect anomalous workflows and limit blast radius.

When Trusted Platforms Become Attack Vectors

This campaign underscores a growing shift toward living-off-the-land attacks within trusted enterprise platforms. 

Rather than relying on overtly malicious infrastructure, attackers repurpose legitimate SaaS capabilities to deliver phishing and social engineering at scale. 

Similar abuse has been observed in platforms such as Salesforce and Amazon SES, where built-in messaging and automation features are leveraged for malicious delivery while appearing operationally normal.

As SaaS ecosystems become more interconnected and deeply embedded in daily workflows, the attack surface is moving away from traditional infrastructure vulnerabilities and toward business logic, identity trust, and workflow assumptions. 

This evolution challenges security teams to rethink detection and defense strategies, focusing less on where a message comes from and more on whether its behavior aligns with expected use.

As attackers abuse trusted platforms and workflows, defenses must shift to zero-trust models that continuously verify identity and behavior.