Spamhaus just shared a post warning that compromised Google Workspace accounts are being used to send phishing and scam emails, with the education sector among the most industry
In the post, Spamhaus revealed that it had identified more than 450 compromised education domains using Google Workspace. The activity is not limited to schools, and the same target domain has appeared across multiple spam campaigns.
Spamhaus noted that attackers initially directed recipients to one domain but are now using links hosted on IP addresses, masked URLs, and less familiar hosting providers. It also observed attackers using Google Drawings as an intermediary: a drawing contains an image and link that redirects the recipient to the attacker’s destination.
There is no indication by Spamhaus that Google Workspace itself has been breached. The issue only affects compromised accounts being abused.
Source
