Service abuse: Google security alert credential phishing

calendar Oct 28, 2026  ·
Share on: linkedin copy

Detects messages spoofing Google's automated account security alert notifications, warning that someone else may be using the recipient's account. These messages either trigger a callback scam intent classifier or embed a suspicious URL disguised as an app name within the alert text, luring recipients into calling a fraudulent number or visiting an attacker-controlled link under the guise of securing their account.

Sublime rule (View on GitHub)

 1name: "Service abuse: Google security alert credential phishing"
 2description: "Detects messages spoofing Google's automated account security alert notifications, warning that someone else may be using the recipient's account. These messages either trigger a callback scam intent classifier or embed a suspicious URL disguised as an app name within the alert text, luring recipients into calling a fraudulent number or visiting an attacker-controlled link under the guise of securing their account."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.email == "no-reply@accounts.google.com"
 8  and (
 9    any(regex.iextract(body.current_thread.text,
10                       'generate this password for (?P<app_name>.+), someone (?:else )?might be using your account'
11        ),
12        any(regex.iextract(.named_groups["app_name"],
13                           '(?:https?://)?(?P<url>[a-z0-9-]+(?:\.[a-z0-9-]+)+/[^\s,]*)'
14            ),
15            strings.parse_url(strings.concat("https://", .named_groups["url"])).domain.valid
16        )
17    )
18  )  
19attack_types:
20  - "Callback Phishing"
21  - "Credential Phishing"
22tactics_and_techniques:
23  - "Impersonation: Brand"
24  - "Social engineering"
25  - "Spoofing"
26detection_methods:
27  - "Natural Language Understanding"
28  - "Content analysis"
29  - "URL analysis"
30  - "Sender analysis"
31id: "34364db5-8852-5997-a5c9-4fd50d897348"
to-top