iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a campaign reported on August 24, 2022, attackers used password-expiry lures and multi-step redirects to steer Google Workspace users—particularly executives and other senior personnel—to Gmail phishing pages designed to steal credentials and session information. The report described activity beginning in mid-July 2022; it does not establish that the campaign is active today.
What the 2022 report found
The Hacker News summarized research by Zscaler researchers Sudeep Singh and Jagadeeswar Ramanukolanu on August 24, 2022. The researchers said the campaign specifically targeted chief executives and other senior members of organizations using Google Workspace. They described the activity as low-volume, but the report provided no numeric count for the Google Workspace campaign.
The activity reportedly began in mid-July 2022. The report also noted overlap between infrastructure used against Microsoft email users and Google Workspace users. In one example, a redirector associated with a Microsoft adversary-in-the-middle (AiTM) attack was changed several days later to route victims to a Gmail AiTM page. The Hacker News’ August 24, 2022 report describes these findings.
How the phishing redirects worked
One reported lure warned recipients that their password was expiring and prompted them to extend access. Clicking its link could send the user through an open redirect operated by Google Ads or Snapchat before loading a phishing page. A redirect allows a URL on one site to forward a visitor elsewhere, which can make the final destination less obvious from the original link.
#1 Best Overall
Another variant began on a compromised website. It hosted a Base64-encoded next-stage redirector and included the victim’s email address in the URL. JavaScript on the intermediate page then directed the victim to a Gmail phishing page. The campaign report describes these routes as ways to lead users to pages intended to capture account information; it does not establish that every recipient followed a link or was compromised.
What AiTM phishing means—and why MFA may not be enough
AiTM means “adversary in the middle.” In this phishing approach, a malicious site sits between a user and a legitimate sign-in service, relaying the interaction while attempting to capture credentials and session information. If an attacker obtains a valid session cookie, that can potentially let them reuse an authenticated session rather than simply trying to sign in with a password.
That is why conventional multi-factor authentication (MFA) should not be treated as a guarantee against every phishing technique. The 2022 report described an attack designed to capture credentials and session information despite MFA protections. It does not show that every form of MFA, every Google Workspace account, or every target was affected.
What could happen after an account is phished
A September 2022 alert from RSM Hong Kong said stolen credentials and session cookies could be used to access mailboxes and support follow-on business email compromise (BEC), such as fraudulent business communications. This was a potential consequence described by the alert—not proof that all targeted organizations or users suffered mailbox access or BEC. See RSM Hong Kong’s September 2022 alert.
Rank #3
How to reduce risk from similar attacks
- Use phishing-resistant authentication where your organization supports it. The Hacker News report relayed Google’s August 2022 statement that hardware security keys could eliminate AiTM attacks. A FIDO2/WebAuthn security key is a general category, not a guarantee that any particular model will work with every organization’s account setup. Check your organization’s configuration and compatibility before purchasing or deploying keys.
- Keep email and link protections enabled. The 2022 report quoted Google describing Gmail’s “layers of phishing protection,” including checks of sender reputation, spoofed logos, sender-recipient affinity, and many other signals. It also said Google’s Safe Browsing service could detect live phishing domains. These were Google’s contemporaneous descriptions reported in August 2022, not an independent assessment of current controls or a promise that every malicious message will be blocked.
- Verify urgent password notices independently. Do not rely on the link in an unexpected expiry message. Open the service through a known bookmark or your organization’s approved sign-in route, or ask IT through a separately verified channel.
- Report suspicious messages promptly. If you clicked a link or entered information, contact your organization’s IT or security team using its normal reporting channel. Prompt reporting can help the team assess account and session risk; the campaign reporting does not prescribe a specific recovery procedure.
What this incident does—and does not—show
The reported targets, redirect techniques, and infrastructure overlap describe a historical campaign, not proof of current activity. The available reporting does not provide a campaign count, establish how many users were compromised, or document the compatibility of specific security-key models. Google’s protections and authentication options may change, so organizations should consult their current account guidance rather than treating statements quoted in 2022 as current guarantees.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
