New Phishing Attack Mimics Google AppSheet to Steal Login Credentials

In the evolving landscape of cyber threats, attackers continually refine their tactics, leveraging legitimate services to bypass traditional security measures. A prime example is the sophisticated phishing campaign recently discovered, which targets Google Workspace organizations by impersonating Google’s own AppSheet platform. This attack underscores a critical shift towards social engineering tactics that exploit inherent trust in cloud services, making it imperative for organizations to understand its mechanics and implement robust defenses.

Understanding the AppSheet Phishing Campaign

Discovered in September 2025, this particular campaign represents a significant escalation in phishing sophistication. Cybercriminals are sending fraudulent emails designed to appear as legitimate notifications or requests originating from Google AppSheet. AppSheet, being a no-code development platform from Google, is inherently trusted by many organizations utilizing Google Workspace. This trust is weaponized by attackers to trick users into divulging their login credentials.

The core of the attack lies in its ability to exploit this trust. The emails are crafted to mimic official communications, often prompting users to review a project, a data source, or an application within AppSheet. These prompts usually contain malicious links that redirect victims to meticulously crafted fake Google login pages. These pages are designed to be visually indistinguishable from genuine Google sign-in portals, making it extremely difficult for an unsuspecting user to differentiate between legitimate and malicious sites.

How the Attack Bypasses Traditional Security

A key characteristic of this campaign is its ability to bypass standard email security protocols. Cybercriminals are increasingly using tactics that involve compromised legitimate accounts or highly evasive techniques to deliver phishing emails. This could include:

• Leveraging Cloud Services: Sending emails from compromised legitimate accounts hosted on cloud platforms, making them appear less suspicious to DMARC, DKIM, and SPF checks.
• Dynamic Link Redirection: Using multiple layers of redirection, often through seemingly benign URLs, to eventually lead to the malicious login page. This can evade URL filtering solutions.
• Low Volume, High Targeting: Sending smaller volumes of highly targeted emails to specific individuals or departments, making them harder to detect through broad behavioral analysis.

The goal is always the same: acquire user credentials, which can then be used for further lateral movement within the organization, data exfiltration, or deployment of ransomware.

Remediation Actions and Proactive Defenses

Mitigating the risk posed by sophisticated phishing attacks like the AppSheet impersonation requires a multi-layered approach focusing on technology, processes, and people.

• Enhanced User Education: Conduct regular, up-to-date training sessions on identifying phishing attempts. Emphasize checking email sender details, scrutinizing URLs before clicking, and recognizing suspicious requests—even if they appear to come from trusted sources. Teach users to hover over links to reveal the true URL.
• Multi-Factor Authentication (MFA): Implement mandatory MFA for all Google Workspace accounts and other critical systems. Even if credentials are compromised, MFA adds a crucial layer of defense against unauthorized access.
• Advanced Email Security Gateways (SEG): Deploy SEGs with advanced threat protection capabilities, including sandboxing, URL rewriting, and AI-driven anomaly detection to identify and block sophisticated phishing attempts.
• Domain Monitoring: Regularly monitor for newly registered domains that are typosquatting on your organization’s domain or commonly used trusted services like AppSheet.
• Incident Response Plan: Ensure a well-defined incident response plan is in place to quickly detect, contain, and eradicate threats in case of a successful phishing compromise. Include specific steps for password resets and system audits.
• Principle of Least Privilege: Enforce the principle of least privilege for all user accounts, limiting access to only the resources absolutely necessary for their role.
• Regular Security Audits: Conduct periodic security audits of Google Workspace configurations to ensure optimal security settings are applied and maintained.

Tools for Detection and Mitigation

Tool Name	Purpose	Link
Google Workspace Security Center	Visibility into Google Workspace security posture, threat investigations.	Google Workspace Security Center
Phishing Simulators	Educate users through realistic phishing simulations and track awareness.	(Varies by vendor, e.g., KnowBe4, Cofense)
Advanced Email Security Gateways (e.g., Proofpoint, Mimecast)	Pre-delivery email threat protection, URL rewriting, sandboxing.	(Varies by vendor)
Identity and Access Management (IAM) Solutions	Enforce MFA, manage user identities and access policies (e.g., Okta, Duo Security).	(Varies by vendor)

Conclusion

The AppSheet phishing campaign serves as a stark reminder that cybercriminals are constantly innovating, exploiting human trust and the perceived legitimacy of cloud platforms. For organizations leveraging Google Workspace, understanding this specific threat and implementing robust security measures—from technical controls like MFA and advanced SEGs to critical user awareness training—is paramount. Staying vigilant and proactive in defenses is the only way to safeguard against sophisticated social engineering attacks and protect valuable digital assets.