On June 23, 2025, Pieter Arntz, a Malware Intelligence Researcher, reported that Russian hackers successfully bypassed Google’s multi-factor authentication (MFA) in Gmail to carry out targeted attacks. The hackers, believed to be a Russian state-sponsored entity due to the sophistication of the campaign, posed as US Department of State officials to trick everyday Google Workplace users.

Avoid app passwords when using Google

The attackers used advanced social engineering to build rapport with targets, then persuaded them to create app-specific passwords. App passwords are 16-digit codes that allow certain apps or devices to access a Google account without the second verification step typically required by MFA. While intended for older or less secure applications, this bypass of the second authentication step made them vulnerable to theft or phishing.

In one example, attackers invited a target to a consultation, sending an email from a Gmail account but carbon-copying fabricated @state.gov addresses to create a false sense of security. As the conversation progressed, the target received an official-looking document with instructions to register for an “MS DoS Guest Tenant” account, which involved creating an app password to “enable secure communications.” The target, believing they were securing access to a State Department platform, unwittingly gave the attackers full access to their Google account.

If your app requires and app password to integrate with Google Workplace – consider using a different app that has it’s own MFA method.

To stay safe, we recommend:

• Only use app passwords when absolutely necessary and switch to apps/devices that support more secure sign-in methods.
• Prioritize stronger MFA methods like authenticator apps or hardware security keys over SMS-based codes. This means no more text message authentication methods!
• Educate yourselves and others on recognizing phishing attempts. Never click on any links from a suspicious or unknown email account.
• Monitor for unusual login attempts and limit logins from unfamiliar locations/devices. You can easily run a security checkup on your Google Workplace account by logging into your account and clicking on the Security tab.
• Regularly update operating systems and applications on your computers, tablets and phones.
• Utilize security software to block malicious domains and recognize scams. Early detection and prevention can save you from a world of problems.
• ALWAYS create strong passwords that are unique and NEVER reuse or share passwords.
• Rotate your passwords on a regular basis.

To read more about this scam read the full article “Gmail’s multi-factor authentication bypassed by hackers to pull off targeted attack” here.

For help with securing your Google Workplace account contact us!