# Mass Phishing and Scam Campaign Abuses 450+ Compromised Google Workspace Accounts in the Education Sector

> Spamhaus identified more than 450 compromised education-sector Google Workspace domains being used to send phishing and scam emails that appear to originate from legitimate organizational senders, evading spam filters tuned to flag newly created sender addresses. The same target domains recur across multiple spam waves and the abuse extends beyond education into other sectors, but Spamhaus has not disclosed the initial access method, message content, or the full list of affected domains.

- **Published:** 2026-08-13T00:00:00Z
- **Last reviewed:** 2026-08-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2004
- **ID:** TL-2026-2004
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-08-12, threat-intelligence organization Spamhaus disclosed that it has identified more than 450 compromised Google Workspace domains in the education sector being actively abused to relay phishing and scam email. Because the messages originate from real, previously-trusted organizational Workspace accounts rather than newly registered attacker infrastructure, they bypass anti-spam heuristics that specifically flag young or unfamiliar sender domains — the account's legitimate reputation and mail history become the evasion mechanism. Reporting on the disclosure additionally notes the campaign shows no single consistent malware family or fixed phishing template, consistent with opportunistic, content-varying abuse of hijacked mailboxes rather than a single scripted lure.

Spamhaus further observed that the same recipient/target domains recur across multiple, separate spam campaign waves, indicating the operators are working from a maintained and reused targeting list rather than opportunistically blasting one-off runs. Spamhaus also states the activity is not confined to education, implying tenants in other verticals are being abused the same way.

Critically, Spamhaus has not published how the underlying Google Workspace accounts were initially compromised, the content of the phishing/scam messages themselves, or a list of the specific affected domains. No CVE or software vulnerability is involved — this is abuse of legitimate cloud-email infrastructure (account takeover), not a code-level flaw. Reporting outlet Cyber Security News surfaced the Spamhaus findings publicly on 2026-08-13, alongside defender-facing mitigation guidance (MFA enforcement, forwarding-rule/OAuth-grant audits, sign-in anomaly monitoring, user phishing-reporting, and out-of-band verification of unusual requests).

Because no specific network/file indicators were disclosed for this campaign, this record grounds its MITRE ATT&CK mapping and defender-facing indicators in (a) the facts Spamhaus published (scale, sector, evasion mechanism, recurrence, lack of a fixed template) and (b) the well-documented general attack chain for Google Workspace account-compromise-for-spam-relay/BEC campaigns as described in independent, contemporaneous security research on this exact class of attack: credential/OAuth-consent phishing and adversary-in-the-middle (AiTM) session-token theft as compromise vectors, and forwarding-rule, mailbox-delegation, OAuth-grant, and inbox-filter abuse as post-compromise persistence and defense-evasion mechanisms (see references). Analysts should treat any specific initial-access vector, C2, or malware attribution for this particular campaign as unconfirmed until Spamhaus publishes further detail; the additional MITRE techniques below reflect the documented mechanics of this attack class, not confirmed specifics of this campaign.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1586.002 Email Accounts
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1528 Steal Application Access Token
- T1557 Adversary-in-the-Middle
- T1078.004 Cloud Accounts
- T1098.002 Additional Email Delegate Permissions
- T1684.001 Impersonation
- T1564.008 Email Hiding Rules
- T1114.003 Email Forwarding Rule
- T1657 Financial Theft

## Sources

- [Hackers Leveraging GoogleWorkspace Accounts to Send Phishing and Scam Emails](https://cybersecuritynews.com/hackers-leveraging-googleworkspace/)
- [How Google Workspace Accounts Get Compromised: The Modern Phishing Attack Chain](https://gatlabs.com/blogpost/google-workspace-phishing-attack-chain/)
- [Google Workspace Phishing Threats Every Admin Should Watch](https://gatlabs.com/blogpost/google-workspace-phishing-threats-admins/)
- [How to Spot a Cyber Scammer in Google Workspace](https://managedmethods.com/blog/how-to-spot-a-cyber-scammer-in-google-workspace/)
- [Spammer Abuse of Free Google Services](https://www.spamhaus.org/news/article/814/spammer-abuse-of-free-google-services)
- [Phishing Campaigns Targeting Higher Education Institutions](https://cloud.google.com/blog/topics/threat-intelligence/phishing-targeting-higher-education)
- ['Google Workspace' phishing emails](https://www.york.ac.uk/students/news/2026/google-phishing-emails/)
- [Google's June 2026 frauds and scams advisory](https://blog.google/innovation-and-ai/technology/safety-security/fraud-scams-advisory-june-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2004