Most phishing awareness training still teaches users to look for spelling mistakes, suspicious links, and unusual senders.
The problem is that many modern phishing attacks no longer look suspicious.
A user reports a concerning email. You review the message, and nothing immediately stands out. The sender appears legitimate. There are no obvious errors. The link is hidden behind a QR code. Another user has already approved access to a third-party application that appeared to come from Google.
This is what modern phishing looks like.
Attackers are using AI to write convincing emails, QR codes to hide destinations, and OAuth permissions to gain access without stealing passwords.
At the same time, Phishing-as-a-Service (PhaaS) platforms are making sophisticated phishing campaigns available to criminals with little technical expertise. Ready-made phishing kits, hosting infrastructure, and credential collection tools can now be rented or purchased, lowering the barrier to entry and increasing the volume of attacks targeting organizations.
As a result, organizations are facing more phishing attempts than ever before, and many of them look increasingly legitimate. Some attacks never trigger traditional security controls because users willingly grant access themselves.
According to a Digital Defense Report, AI-assisted phishing campaigns now achieve a 54% click-through rate, compared to 12% for traditional campaigns. That is a 450% increase in effectiveness, without any increase in volume.
For Google Workspace admins, that creates a new challenge. The question is no longer just how to block phishing emails. It’s about identifying compromised accounts, understanding what happened after a user interacted with an attack, and responding before sensitive data is exposed.
In this article, we look at the phishing techniques gaining traction in Google Workspace environments and what they mean for how you manage your domain.
Key Takeaways
| Key Takeaway | Why It Matters |
|---|---|
| Modern phishing attacks increasingly use AI-generated content, QR codes, OAuth abuse, and Phishing-as-a-Service (PhaaS) platforms. | Attackers can launch more convincing campaigns at greater scale with less technical expertise. |
| Investigating a phishing incident requires visibility beyond Gmail. | Account activity, Google Drive, third-party applications, and user behavior often reveal the true scope of an incident. |
| Attackers frequently establish persistence after gaining access. | Forwarding rules, mailbox delegations, and OAuth applications can allow continued access even after credentials are changed. |
| Understanding who received the email and how they interacted with it is critical. | Determining the blast radius helps security teams prioritize containment and remediation efforts. |
| User awareness training and phishing simulations remain essential. | Regular training helps reduce risk and identify areas where users may need additional support. |
Why Modern Phishing Looks Different
Many admins still expect phishing emails to be relatively easy to identify. Attackers write some of today’s phishing emails better than legitimate business emails.
Artificial intelligence has made it easier for attackers to create convincing messages that match a company’s tone, branding, and communication style. A phishing email can now look like a routine request from HR, a shared Google Drive file, a vendor invoice, or a message from a senior executive.
APWG recorded over 971,000 phishing attacks in Q1 2026 alone, a 13.8% increase on Q4 2025. SaaS and webmail platforms, including Google Workspace, are among the most frequently targeted sectors.
At the same time, attackers are finding new ways to bypass traditional email security controls. QR code phishing, often called “quishing”, is one example. Instead of including a clickable link, the attacker embeds a QR code inside the email or an attached document. After scanning the code, the user visits a phishing site that may sit outside the protections available on their work device. Many traditional email security controls focus on links and attachments, which can make QR-code-based attacks more difficult to detect.
The challenge for Google Workspace admins is that users often report these emails only after they have clicked a link, scanned a code, entered credentials, or approved access. By that stage, the investigation has already moved beyond the inbox.
That is why phishing response should never focus solely on the email itself. Understanding what happened after the interaction is often more important than understanding how the email arrived.
Why OAuth Attacks Are Catching Organizations Off Guard
One of the fastest-growing phishing techniques does not involve stealing passwords at all.
Instead, attackers trick users into approving a third-party application that requests access to their Google account. The user sees what appears to be a legitimate Google consent screen and clicks “Allow,” often believing they are authorizing a trusted service.
Once approved, the application may gain access to Gmail, Google Drive, contacts, calendars, or other Workspace data, depending on the permissions requested.
Imagine an employee receives what appears to be a Google Drive notification asking them to review a document. Instead of seeing a fake login page, users see a legitimate Google consent screen requesting access to their account. Because the screen comes directly from Google, many users assume it is safe and click “Allow.” From an administrator’s perspective, these incidents can be difficult to identify because the user technically granted the access themselves.
What makes these attacks particularly dangerous is that they can bypass many of the warning signs users have been trained to look for. There is no fake login page, no password theft, and often no indication that anything malicious has happened.
For many organizations, third-party application access is a significant blind spot. Password policies, multi-factor authentication, and email filtering may all be in place, yet users can still grant extensive access to external applications without realising the risk. Regularly auditing the third-party apps connected to your domain and the permissions each one holds should be a standard part of every Google Workspace security review, not an occasional task.
A note for EU and UK admins: Under NIS2, organizations in critical sectors are required to implement risk-management measures and monitor for compromise continuously. Under GDPR, a data breach triggered by a phishing attack, including one caused by OAuth consent abuse, must be reported to your supervisory authority within 72 hours if it creates risk for individuals. OAuth attacks are particularly difficult to document after the fact, which is why proactive auditing of app permissions is not just good practice; it is part of your compliance posture.
What to Investigate After a Suspected Phishing Attack
When users report a phishing incident, start by determining whether they simply received the email or whether the attack progressed further.
1. Start with account activity.
Look for unusual login locations, unfamiliar devices, failed sign-in attempts, or sessions outside normal working hours. These events help establish whether the account was accessed by someone other than the user. With GAT+, you can set up alerts that fire when a user logs in from outside their expected city or country, so you are notified immediately rather than finding out during a post-incident review.
2. Review Gmail for persistence mechanisms.
Attackers who successfully compromise an account often create forwarding rules, modify inbox settings, or add mailbox delegations to maintain access. These changes can sit undetected for weeks if nobody is actively looking.
GAT+ can alert administrators when a new Gmail filter is created, email forwarding is configured, or email delegation is enabled. These alerts help identify persistence attempts early, rather than discovering them later during a post-incident investigation.
3. Include Google Drive in the scope.
A compromised account may be used to access sensitive files, download information, create external shares, or publish content to the web. In many incidents, attackers spend more time in Drive than they do in email. GAT+ lets you view every action taken in Drive by a specific user, including file access, downloads, external shares, and permission changes, so you can reconstruct exactly what was accessed after the initial compromise.
4. Audit third-party app permissions.
If the user approved an OAuth application, investigate the permissions granted and determine what data the application may have accessed. The Applications section in GAT+ shows every third-party app authorised across your domain, the scopes each app holds, and an automatic risk score. You can identify and revoke suspicious grants without having to contact each user individually.
The goal is to build a complete timeline of events. The phishing email is only one piece of the picture. Effective Google Workspace phishing protection requires visibility that extends across Gmail, Drive, connected apps, and user activity, not just the inbox.
Building a Stronger Phishing Response Process
No organization can prevent every phishing attempt from reaching users. The APWG and FBI data make that clear. Volume is high, effectiveness is rising, and the attacks are increasingly hard to detect before delivery.
The difference between a contained incident and a significant security event comes down to how fast you can understand what happened and act on it.
A strong response process starts with visibility. You need to identify who received the email, who opened or interacted with it, what actions they took afterward, and what data they may have exposed. That visibility has to extend beyond Gmail to include Drive activity, third-party applications, sharing behaviour, and user access patterns across the domain.
GAT+ provides this level of cross-domain audit capability, covering Gmail, Drive, Contacts, Calendar, and connected applications from a single interface.
The biggest mistake organizations make is treating phishing as an email problem. In most cases, the email is only the entry point. The real damage happens afterward: a silent forwarding rule exfiltrating correspondence, an OAuth app reading Drive, an attacker sitting in a mailbox watching for payment instructions or HR data.
For US admins: The FBI’s Internet Crime Complaint Center (IC3) reported $2.8 billion in business email compromise (BEC) losses in the US in 2024 alone. BEC attacks almost always begin with a phishing compromise. Building a response process that can contain a compromised account within minutes rather than hours is the most direct way to reduce that exposure.
Once an incident is identified, you need to be able to act at scale. That means finding and removing the phishing email from every inbox on your domain before more users interact with it, not just flagging it in one account. It means revoking OAuth grants, removing forwarding rules, and documenting every step for your audit log.
Waiting until a compromise happens to decide what to investigate leads to delays, missed evidence, and a harder conversation with your leadership or regulator.
FAQ
1. What are the most common phishing threats in Google Workspace?
The most common phishing threats in Google Workspace include AI-generated phishing emails, QR code phishing attacks, and OAuth consent scams.
Business email compromise (BEC) attempts and credential theft campaigns are also common. Attackers disguise these emails as legitimate business communications, making them harder for users to identify.
2. Can a phishing attack compromise Google Workspace without stealing a password?
Yes. OAuth phishing attacks can grant third-party applications access to Gmail, Google Drive, Calendar, and other Workspace services without requiring an attacker to steal the user’s password. Users unknowingly approve access through a legitimate-looking Google consent screen.
3. What should Google Admins check after a user reports a phishing email?
Admins should review recent sign-in activity. Things like Gmail forwarding rules, mailbox delegations, third-party app approvals, Google Drive activity, access permissions, and any external sharing actions. The goal is to determine whether the user only received the email or if the attack resulted in account compromise or data exposure. If an account has been compromised, attackers will often attempt to escalate privileges. They will also expand access to additional data or establish persistence through forwarding rules, delegated access, or OAuth applications.
4. Can I remove phishing emails from multiple Google Workspace inboxes at once?
Yes. Google Workspace administrators can identify malicious emails and remove them from multiple users’ inboxes as part of a phishing remediation process. This helps administrators prevent users from interacting with known threats after reporting or detecting them.
Learn how: Delete Phishing Emails with GAT+
5. What is the difference between phishing detection and phishing response?
Phishing detection focuses on identifying suspicious emails and user activity before attackers can escalate an incident. Phishing response starts when someone reports a suspected attack. Security teams investigate what happened, determine what attackers accessed, remove threats, and reduce the risk of further compromise.
Once security teams contain the incident, they should focus on preventing similar attacks in the future. This includes reviewing security controls, improving user awareness, and providing regular phishing training. Many organizations now run phishing simulations alongside traditional security awareness programs. These exercises expose users to realistic but controlled phishing attempts and help administrators identify areas that need additional training.
Insights That Matter. In Your Inbox.
Join our newsletter for practical tips on managing, securing, and getting the most out of Google Workspace, designed with Admins and IT teams in mind.
