Malicious emails disguised as security alerts from Google and Microsoft
The habit of identifying phishing emails based on suspicious sender addresses or misspelled domain names is quickly becoming obsolete. Recently, sophisticated phishing campaigns have shifted toward exploiting the actual infrastructure, servers, and native features of the world’s two most ubiquitous tech platforms: Google and Microsoft. As a result, malicious emails land in inboxes backed by fully validated digital signatures and originating from legitimate systems, making them exceptionally difficult to detect.
Injecting malicious content via Google security notifications
A newly observed tactic on the Gmail platform demonstrates how threat actors can leverage Google's own infrastructure to distribute credential-harvesting links. Specifically, attackers use an account under their control and add the victim’s email address as a recovery email. Even without the recipient's consent or verification of this link, Google’s automated system may still dispatch official security alerts to the designated target address.
The exploit hinges on the subsequent interaction: attackers generate an App Password on their account. Because this feature allows users to assign custom descriptive names, adversaries deliberately enter fabricated, urgent security warnings containing phishing links. Immediately afterward, Google automatically dispatches an authentic security alert to the victim’s inbox, quoting verbatim the custom name created by the attacker.
Because the email originates directly from Google’s servers and carries valid technical authentication, recipients are easily misled into believing their account is at risk. If they panic and click the link, they are redirected to a phishing landing page designed to capture credentials or authentication codes, handing full account takeover privileges to the attackers.
Over 31,000 malicious emails and open redirect traps on Microsoft platforms
Threat actors are not limiting themselves to consumer accounts; Microsoft’s enterprise ecosystem has also become a prime target for abuse. Cybersecurity firm Kaspersky recently uncovered a large-scale campaign, detecting and mitigating over 31,000 phishing emails between August 1 and September 18. Instead of relying on typosquatted domains, attackers directly abused legitimate Microsoft links and authentication workflows.
These emails are typically disguised as urgent system notifications, such as prompts to update login credentials or sign critical electronic documents. To execute this, attackers create accounts to access the Microsoft Entra admin center. Under App registrations, they configure a malicious external URL into the "Redirect URI" field - a standard parameter meant to route users post-authentication. When victims click the legitimate Microsoft-domain link inside the email, the system automatically redirects them to a malicious site designed to harvest credentials or drop malware directly onto the endpoint.
Additionally, adversaries abuse Microsoft trial subscriptions or low-cost tiers to trigger automated notification workflows. By injecting deceptive phishing lures into display fields, titles, or signatures and entering the victim's address as a recovery mailbox, the resulting emails originate entirely from Microsoft servers with valid links, rendering them virtually undetectable to conventional email security filters.
Why sender verification is no longer enough
The most dangerous aspect of these campaigns is that the boundary between authentic and fraudulent communications has effectively blurred. Both the sender address and domain visibly belong to Google or Microsoft, seamlessly passing standard origin and authentication checks.
Consequently, relying solely on sender reputation or brand legitimacy is no longer a viable defense. Users must evaluate incoming messages within their operational context: Did I actually initiate a password reset, register an account, or request an authentication code? Any urgent notification arriving out of sequence or without prior user action must be treated with high suspicion.
Account defense & Mitigation strategies
To counter attacks leveraging legitimate cloud services, cybersecurity experts recommend that individuals and organizations adhere to the following best practices:
Avoid clicking any links in emails requesting identity verification, password updates, or urgent document approvals, even if the email originates from a trusted platform.
Never use verification codes or access attached links unless you explicitly initiated the request yourself.
When verifying account security status, open a browser manually, type the official service URL directly, or use a dedicated application rather than following embedded links in emails.
Always scrutinize the operational context and intent of the message, maintaining heightened vigilance toward high-pressure, urgent demands.
Implement Multi-Factor Authentication (MFA) using phishing-resistant methods to safeguard accounts against compromised credentials.
Deploy specialized enterprise security solutions capable of behavioral analysis, advanced phishing detection, and malware prevention across both endpoints and cloud environments.
An email dispatched from legitimate servers does not guarantee that the content inside is benign. Exercising caution with every operational request and independently verifying actions directly on the official platform remains the most critical line of defense for safeguarding digital assets.
Within enterprise environments, relying solely on employee vigilance is insufficient against sophisticated campaigns exploiting trusted infrastructures like Google and Microsoft. To proactively assess vulnerabilities and establish multi-layered defense architectures across cloud and email ecosystems, organizations can leverage comprehensive IT management and cybersecurity solutions from IPSIP Vietnam, enabling early anomaly detection and safeguarding digital enterprise assets.
