How BEC Attackers Abuse Google Workspace Identity Features
Summary
The article explains how BEC campaigns can use stolen credentials, tokens, OAuth abuse, mailbox manipulation and forwarding rules to expand access and hide activity. It recommends monitoring identity behavior and correlating activity across SaaS platforms.
Key points
- BEC campaigns may begin with stolen credentials, session hijacking or OAuth abuse, then expand through discovery, mailbox manipulation, fraud and persistence.
- Attackers can use Gmail to access other SaaS accounts by exploiting password resets, emailed MFA codes, OAuth workflows and recovery links.
- Mailbox filters that hide security alerts, password reset messages or victim replies can conceal compromise.
- Attackers may send phishing from trusted accounts and use forwarding rules or persistent OAuth tokens to retain access.
- The article recommends monitoring authentication, token activity, OAuth consent, mailbox changes and cross-platform SaaS access together.
- Huntress says it is expanding its identity detection and response offering to Google Workspace. This vendor announcement appears alongside a product promotion.
Article Details
- Topic
- Business email compromise as an identity-security problem, with attackers abusing Google Workspace accounts and features for stealth, persistence, and lateral movement.
MITRE ATT&CK
T1114.003 · Email Forwarding RuleAttackers create forwarding rules to exfiltrate inbound mail and maintain visibility into compromised accounts.T1564.008 · Email Hiding RulesAttackers create mailbox filters that delete or archive security alerts, password-reset confirmations, MFA notifications, and victim replies to hide evidence of compromise.