Beware! New Phishing Campaign Exploits Google Tasks Notifications to Target Corporate Credentials

A global cybersecurity company, Kaspersky, has revealed a new phishing scheme targeting corporate users by misusing the legitimate Google Tasks service. This attack is designed to steal corporate login credentials by exploiting users’ trust in the Google ecosystem.

Attackers utilise official @google.com email domains and trusted notification systems to bypass traditional email security filters.

In this campaign, victims receive emails with the subject “You have a new task” that appear highly authentic.

The message is crafted to create the illusion that the recipient’s company has adopted Google’s task management tool.

To prompt a quick response, the perpetrators include elements of urgency such as a “high priority” flag and tight deadlines.

If users click the embedded link, they are directed to a fake form masquerading as an “employee verification” page.

There, employees are asked to enter corporate credentials under the pretext of confirming employment status.

The stolen credentials are then used by the attackers for unauthorised access to internal systems, data theft, and more extensive subsequent attacks.

Roman Dedenok, Kaspersky’s Anti-Spam Expert, emphasises that this tactic is part of a broader trend where cybercriminals misuse popular platforms to deceive victims.

“The vast Google services ecosystem is exploited by scammers. The scheme with Google Tasks is part of a wider trend observed previously and continuing until 2026, where cybercriminals abuse legitimate platforms to spread scams and phishing. Notifications originating from legitimate domains naturally evade many spam and phishing filters, while the social engineering aspect – making it appear as an internal company process – potentially lowers victims’ vigilance,” said Roman.