Google Workspace Identity Attacks: OAuth Abuse, SIM Swaps, and MFA Bypass

What do the latest Google Workspace security statistics show?

Note: Statistics are from SQ Magazine’s Google Workspace statistics report.

These attacks use different methods, but they share one outcome: attackers can gain or abuse authorized access without simply guessing a password. A successful login alone does not always prove the legitimate user is behind the account.

How does OAuth abuse work in Google Workspace?

In an OAuth attack, the attacker convinces a user to approve a malicious app on a consent screen. The app then receives access to the scopes the user granted. No password is stolen, and the authorization itself is the attack path.

SQ Magazine reports OAuth abuse rose about 2,000% between October 2025 and January 2026, alongside a 45% rise in consent events.

Passwords and MFA alone do not address malicious OAuth authorization. Admins need to know which third-party apps users have authorized, what those apps can access, and whether they are still in use. Our OAuth app security guide covers the audit steps. If you want the wider picture, see our shadow IT guide for Google Workspace.

What is a SIM swap attack, and why does it affect Google Workspace?

In a SIM swap, an attacker moves a victim’s phone number to a SIM they control. SMS codes and calls then go to the attacker. Any organization that relies on SMS for authentication exposes that factor.

SQ Magazine reports SIM swapping campaigns against Google Workspace users increased 45% during 2025. The average time to account takeover after a successful swap was 2.3 hours.

Moving users from SMS-based authentication to passkeys or security keys reduces exposure to SIM-swap attacks. Our MFA guide for Google admins covers the options.

Can attackers bypass MFA in Google Workspace?

Yes. Some MFA methods remain vulnerable to phishing, SIM swapping, adversary-in-the-middle attacks, and stolen session cookies.

SMS-based authentication is particularly vulnerable to SIM swapping because attackers who take control of a phone number may intercept verification codes.

This doesn’t make MFA ineffective. It makes the authentication method matter. Google Workspace admins should prioritize phishing-resistant methods, such as passkeys and security keys, and reduce reliance on SMS-based verification.

How does external sharing turn a compromised account into a data breach?

An attacker with access to a Drive account does not need malware. They can share files externally using native features.

SQ Magazine reports malicious external sharing link creation rose 56% during 2025, and those sharing configurations stayed active for an average of 43 hours before security teams detected them.

That window is the exposure. You need to see external shares as they are created and remove them quickly. GAT+ reports on externally shared files and lets you remove shares in bulk. 

Why is authentication at login not enough?

Passwords, MFA, passkeys, and security keys answer one question: can this person prove they are authorized to access the account?

Once authentication succeeds, the session continues beyond the initial identity check. Google provides protections against threats such as stolen session cookies, but login authentication does not continuously verify the identity of the person physically using the browser.

That distinction matters. An authenticated session can still become a target for account takeover, session hijacking, or unauthorized use.

What should Google Workspace admins review?

Use Cybersecurity Awareness Month to review controls across the full session:

• – OAuth access: Review third-party apps, requested scopes, connected users, and dormant authorizations.
• – Authentication methods: Move users from SMS to passkeys or security keys.
• – External sharing: Monitor Drive permission changes and investigate unexpected external access quickly.
• – Browser activity: Look for unusual browsing, downloads, or app access after login.
• – Session identity: Decide how you will confirm the person using an authenticated account is the legitimate user.

What is GAT Shield+ ActiveID?

Shield+ provides premium security for enterprises using Chrome. Building on GAT Shield, it adds advanced browser protection, including continuous identity verification through ActiveID™.

ActiveID™ measures the timing of a user’s keystrokes without recording what they type. Machine learning models compare these patterns against the user’s established profile throughout the browser session.

If typing behavior doesn’t match the expected user with sufficient confidence, Shield+ alerts the admin and triggers the configured response. Depending on the security policy, this can include requesting passkey authentication or clearing browser cookies to end active sessions.

The Shield+ overview covers setup.

FAQs

Which Google Workspace identity threat showed the fastest growth?
According to a 2026 security research, Google Workspace OAuth abuse increased by approximately 2,000% between September 2025 and February 2026 across its monitored environments. OAuth consent events also increased by 45% between October 2025 and January 2026.

These findings highlight why administrators need visibility into third-party applications and the permissions users grant them.

Is SMS-based MFA safe for Google Workspace?
SMS-based MFA provides additional protection compared with passwords alone, but it is more vulnerable to phishing and SIM-swapping attacks than phishing-resistant methods. Google Workspace admins should prioritize passkeys and security keys where possible.

How can admins detect a hijacked session in Google Workspace?
Monitor post-login browser activity, watch for unexpected external shares, investigate suspicious session activity, and consider continuous identity verification such as GAT Shield+ ActiveID.

Does ActiveID record what users type?
No. It analyzes typing timing, not the words typed.

Verify identity after login

Attackers can steal credentials, exploit MFA weaknesses, and hijack authenticated sessions. That’s why security shouldn’t stop at sign-in.

GAT Shield+ ActiveID adds continuous identity verification inside Chrome, analyzing typing patterns to help identify when an authenticated session may be used by someone other than the expected user.

See how GAT Shield+ verifies identity beyond login →