Amid a surge of enterprise-targeted phishing, attackers have repurposed Google’s AppSheet no-code platform to launch a sophisticated credential-stealing campaign that effortlessly bypasses traditional email security filters.
By weaponizing AppSheet’s perfectly authenticated infrastructure, threat actors send fully legitimate-looking messages from “noreply@appsheet.com” that pass SPF, DKIM, and DMARC validation, exploiting the inherent trust organizations place in Google Cloud services.
Abuse of Legitimate Infrastructure
In this campaign, phishers register AppSheet accounts and craft automated notifications mimicking legitimate system alerts.
Emails feature official branding and precise formatting, including header banners, trademarked logos, and standardized footer links that direct to a Google URL shortener (goo.su).
Beneath the facade, the shortened link redirects victims to a clone of the Google Workspace login portal hosted on a reputable platform.
Once credentials are entered, they are harvested and immediately exfiltrated. Because messages originate from Google’s own mail servers, they evade detection by Secure Email Gateways that rely solely on technical authentication checks and domain reputation.
Security telemetry reveals that in March 2025, 10.88% of global phishing emails used AppSheet infrastructure, 98.23% impersonated Meta, and the remainder targeted PayPal, leveraging polymorphic message identifiers and man-in-the-middle proxy tactics to maintain stealth.
Those campaigns employed unique AppSheet notification IDs for each email to thwart signature-based detection, while hosting landing pages on trusted CDNs like Vercel.
Need for Context-Aware Defenses
Traditional defences are ill-equipped for this vector. Reputation-based allowlists automatically trust appsheet.com, as indicated by a green SPF/DKIM/DMARC status. Content filtering fails because the email payload originates from approved templates.
Only a contextual analysis engine capable of understanding the relationship between sender and message purpose can distinguish a legitimate AppSheet workflow notification from a bogus trademark violation alert.
Raven AI’s context-aware detector, for instance, flagged these emails by correlating expected AppSheet use cases with anomalous subject-body patterns and identifying goo.su as an inconsistent link shortener uncommon in genuine AppSheet communications.
Enterprises must therefore pivot from binary authentication checks toward behaviorally informed security.
Email systems should incorporate dynamic policies that model typical service-to-user interactions, flag departures in tone, intent, or URL patterns, and cross-verify automated messages against service usage logs to ensure accuracy.
Administrators should also enforce independent verification steps for high-risk notices, especially those that invoke legal or compliance actions.
The AppSheet phishing campaign highlights a fundamental flaw in legacy email security: prioritizing infrastructure over intent.
As attackers continue to weaponize legitimate platforms, security teams must adopt smarter, context-driven defences to prevent trusted services from becoming Trojan horses within their own networks.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
