Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services
Summary: Google fixed an authentication weakness that let attackers bypass email verification when creating Email Verified Google Workspace accounts, using a specially constructed request that paired one email address for sign-in with a different one to verify the token. Google's Anu Yamunan said the activity began in late June and involved a few thousand Workspace accounts created without domain verification, which attackers then used to impersonate domain holders at third-party services through Sign in with Google; Google said it fixed the issue within 72 hours of discovery.
Key Takeaway: A few thousand accounts were created without anyone proving control of the domain, and at least one reader's domain was tied to a Workspace account that was then used to sign in to his Dropbox account - so a single sign-on trust decision made by a third-party service rested on a verification step Google had left bypassable.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026