Google’s Own Alerts Used in Gmail Phishing Attack — Why Passwords Are Now Officially Dead

This week’s Gmail breach didn’t just trick users — it hijacked Google’s trusted infrastructure. Here’s why switching to passkeys is no longer optional.

Saurabh Chauhan June 20, 2025Last Updated: June 20, 2025

43,838 3 minutes read

｜

Reviewed & Published by HH News Desk

New Delhi, June 20: Another week, another Gmail breach—and this one’s gnarly. Google has confirmed that its own infrastructure was quietly exploited in a fresh phishing campaign targeting unsuspecting users, flipping the script on who you can trust in your inbox. Spoiler: if that password’s still your dog’s name and your 2FA code comes via SMS, you’re basically handing over the keys.

This wasn’t some brute-force brute. The attackers played it smooth—weaponising official-looking Google alerts, piggybacking on Google’s trusted domains, and bypassing spam filters like seasoned insiders. It worked because it was real. The alerts were generated through legitimate infrastructure, then repurposed to extract App-Specific Passwords (ASPs)—those temporary logins you might’ve used once for an old email client and forgot about.

Gmail’s Weakest Link: Humans, Again

Google’s backend didn’t get “hacked” in the Hollywood sense. But threat actors, reportedly tied to a group known as Rockfoils, exploited a very human vulnerability: panic. They tricked users into thinking they had received a subpoena—or some urgent legal threat—then convinced them to generate ASPs and hand them over. It’s clever, horrible, and depressingly effective.

The most brutal part? These phishing attacks didn’t look like phishing. They didn’t come from sketchy URLs or trigger red flags. They passed Gmail’s own security protocols—DMARC, SPF, DKIM—because they were Gmail alerts. That’s like someone robbing your house using your own key under the doormat.

Passwords Are Done. Passkeys Are the Future.

So here’s the real headline: passwords are finally circling the drain, and Google wants to be the one pulling the plug. Their weapon of choice? Passkeys—a login method that doesn’t ask for your password, doesn’t rely on a code, and can’t be intercepted. Instead, it uses the security hardware you already have: your phone, your fingerprint, your face.

If you’ve ever unlocked your phone with your face and thought, “Why can’t all logins be this easy?” — good news. That’s the idea.

Passkeys merge your identity (login ID), secret (private key), and confirmation (biometrics or PIN) into a single action. No typing. No guessing. And most importantly: no way to phish or forward the login to someone else, even by accident. It only works on your actual device.

Google’s Plan to Kill Passwords

This week, Google started nudging—okay, lightly shoving—Gmail’s 1.8 billion users to ditch the old model. If you’re still using just a password, or even SMS 2FA, expect push notifications urging you to upgrade. They’re giving users about 15–30 days before access might be limited. It’s not a threat. It’s a favor.

As Google sees it, your Gmail account isn’t just for email. It’s a passport to everything: YouTube, Maps, Docs, Drive, Android, and any app that uses “Sign in with Google.” That’s a huge blast radius for a single compromised login.

The new model is like this: tie everything to your most secure device, lock it with biometrics, and eliminate the weak links—password reuse, SMS hijacks, email phishing. Because let’s be honest, most of us are still using one of the same three passwords we’ve had since college.

The 16 Billion Problem

Context matters, too. This Gmail attack dropped just as over 16 billion usernames and passwords were dumped on the dark web—an absurdly massive trove affecting not just Google, but Facebook, Apple, and more. According to IndiaTimes, while it’s not a single data breach per se, it reflects years of leaks stitched together into one searchable, terrifying dataset.

So even if you weren’t targeted this week, your old login from that forum in 2014 might now be fuelling a brute-force script somewhere. And if you still reuse that password today… well, you just rolled the dice.

Okay, So What Do You Actually Do?

Let’s keep it real: passkeys are the most elegant, frictionless upgrade to internet security we’ve had in years. But if you’re not ready to dive in, do at least this today:

Drop SMS 2FA. It’s vulnerable to SIM swap attacks and social engineering.
Use an authenticator app like Google Authenticator, Aegis, or Authy.
Enable Google’s Advanced Protection Program if you’re a journalist, activist, or just deeply unlucky.
If you must use passwords, store them in a good password manager. Don’t wing it.

And maybe—just maybe—say goodbye to passwords altogether. Because the next attack? It might not knock politely.

Stay informed with Hindustan Herald—your go-to source for Politics, Business, Sports, Entertainment, Lifestyle & more.

Follow us on Facebook, Instagram, Twitter, LinkedIn, YouTube, and join our Telegram channel @hindustanherald

Author Profile

Saurabh Chauhan

Editor - Tech & Ai at Hindustan Herald

Saurabh Chauhan is a tech-savvy eLearning specialist with a keen focus on xAPI, SCORM, LMS, and LRS. As co-founder of SV Tech World on YouTube, he explored gadgets and digital tools. At Hindustan Herald, he now breaks down complex tech topics, making innovation accessible and relevant for curious minds.