Skip to navigation

Threat reportPhishingTL-2026-2695

Google Account Security Team Impersonation Vishing Campaign — Telegram Recruitment Ad Leaks Call Script

mediumACTIVE

Trellix Advanced Research Center's Dark Web Roast (August 2026 edition) surfaced a Telegram recruitment ad — posted by "Derian" (@crɑick) in the "UK Fraudsters" channel — hiring US/Canada-based, 'white sounding' callers for a voice-phishing (vishing) operation impersonating Google's Account Security Team.

Key facts

IdentifiersTL-2026-2695
Also known asGoogle Account Security Team vishing scam, Google Security Team phone scam
SeverityMEDIUM
First disclosed
Affected productsGoogle Google Account (consumer Gmail / Google Workspace end-user account-recovery and MFA workflow)
AttributionDerian (low confidence)
MITRE ATT&CK techniquesT1078 Valid Accounts, T1098 Account Manipulation, T1098.005 Device Registration, T1111 Multi-Factor Authentication Interception, T1531 Account Access Removal, T1566.004 Spearphishing Voice, T1585.001 Social Media Accounts, T1589 Gather Victim Identity Information, T1621 Multi-Factor Authentication Request Generation, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorsconsumer individual account holders, cloud-hosted enterprise environments broader vishing trend context
Target regionsunited states of america, canada
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2695 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Google Account Recovery Email/Phone or 2SV Enrollment Changed Shortly After Verification Challenge (Post-Vishing Account Manipulation) — SPL

Detects a Google Workspace recovery-email change, recovery-phone change, or new 2-Step Verification enrollment occurring within 15 minutes of a login/2SV verification challenge event on the same account. This is the account-manipulation step attackers take immediately after a vishing call coerces prompt approval or a read-back code, per Caldera Cybersecurity's breakdown of this exact 'Google Account Security Team' scam — the caller uses the code/approval to change recovery settings and lock out the legitimate owner.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1098, T1098.005, T1531
  • Data sources: google_workspace_user_accounts_audit_logs (google:gsuite:reports:user_accounts), google_workspace_login_audit_logs (google:gsuite:reports:login)
  • Severity: critical
  • Confidence: high

Splunk SPL

`comment("Detects a Google Workspace recovery-email/phone change or 2SV enrollment within 15 minutes of a login/2SV verification challenge on the same account -- the post-call account-manipulation step of the Google Account Security Team vishing scam.")`
index=gws_reports sourcetype="google:gsuite:reports:user_accounts" event_name IN ("recovery_email_edit","recovery_phone_edit","2sv_enroll")
| eval user=lower(actor_email), manip_time=_time
| join type=inner user
    [ search index=gws_reports sourcetype="google:gsuite:reports:login" event_name IN ("login_verification","2sv_verify","login_challenge")
      | eval user=lower(actor_email), verify_time=_time
      | table user, verify_time ]
| eval delta_sec=manip_time-verify_time
| where delta_sec>=0 AND delta_sec<=900
| table manip_time, user, event_name, new_value, old_value, ipAddress, verify_time, delta_sec
| sort - manip_time

Microsoft KQL

GWorkspace_ReportsAPI_user_accounts_CL
| where TimeGenerated > ago(24h)
| where EventName_s in ("recovery_email_edit", "recovery_phone_edit", "2sv_enroll")
| project ManipTime = TimeGenerated, User = tolower(ActorEmail_s), EventName_s, NewValue_s, OldValue_s, IpAddress_s
| join kind=inner (
    GWorkspace_ReportsAPI_login_CL
    | where TimeGenerated > ago(24h)
    | where EventName_s in ("login_verification", "2sv_verify", "login_challenge")
    | project VerifyTime = TimeGenerated, User = tolower(ActorEmail_s)
) on User
| where ManipTime >= VerifyTime and datetime_diff('second', ManipTime, VerifyTime) <= 900
| project ManipTime, User, EventName_s, NewValue_s, OldValue_s, IpAddress_s, VerifyTime

Sigma

title: Google Workspace Recovery Email/Phone or 2SV Enrollment Change Shortly After Verification Challenge (Post-Vishing Account Manipulation)
id: 1d2e3f4a-5b6c-4d7e-8f9a-0b1c2d3e4f85
status: experimental
description: >
    Detects a Google Workspace recovery-email change, recovery-phone change, or new
    2-Step Verification enrollment. High-fidelity when it follows a login/2SV
    verification challenge event on the same account within ~15 minutes, matching the
    documented post-call account-takeover step where a caller who obtained a verbally
    relayed code or an approved device prompt immediately alters the account's
    recovery settings to lock out the legitimate owner (Caldera Cybersecurity;
    Trellix Dark Web Roast, August 2026).
references:
    - https://calderacyber.com/this-is-google-security-dont-fall-for-this-mfa-scam/
    - https://www.trellix.com/blogs/research/dark-web-roast-august-2026-edition/
author: Threadlinqs Team
date: 2026-09-27
tags:
    - attack.persistence
    - attack.t1098
    - attack.t1098.005
    - attack.impact
    - attack.t1531
logsource:
    product: google_workspace
    service: user_accounts
detection:
    selection:
        event_name:
            - recovery_email_edit
            - recovery_phone_edit
            - 2sv_enroll
    condition: selection
falsepositives:
    - User-initiated recovery-info update from a recognized device with no preceding unexplained verification challenge
    - IT-driven bulk 2SV enrollment campaign
level: high

Known false positives:

  • User-initiated recovery-info update from a recognized device with no preceding unexplained verification challenge
  • IT-driven bulk 2SV enrollment campaign

Tuning notes: Tune the 15-minute manipulation window against observed dwell time between MFA approval and recovery-info change; exclude known bulk 2SV enrollment campaigns by admin/service-account actor; escalate to highest severity when both recovery_phone_edit and recovery_email_edit fire for the same user within the window (full lockout setup).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Google Workspace 2SV/Verification Challenge Approved Following Unverified Inbound Call (Vishing MFA Coercion) — KQL · unlock with TL Creds
  • Google Account Recovery Email/Phone or 2SV Enrollment Changed Shortly After Verification Challenge (Post-Vishing Account Manipulation) — KQL · unlock with TL Creds
  • Anomalous-Geolocation Sign-In or New OAuth App Authorization Following Recovery-Info Change (Valid Account Abuse Post-Takeover) — KQL · unlock with TL Creds
  • Google Workspace 2SV/Verification Challenge Approved Following Unverified Inbound Call (Vishing MFA Coercion) — Sigma · unlock with TL Creds
  • Google Account Recovery Email/Phone or 2SV Enrollment Changed Shortly After Verification Challenge (Post-Vishing Account Manipulation) — Sigma · unlock with TL Creds
  • Anomalous-Geolocation Sign-In or New OAuth App Authorization Following Recovery-Info Change (Valid Account Abuse Post-Takeover) — Sigma · unlock with TL Creds
  • Google Workspace 2SV/Verification Challenge Approved Following Unverified Inbound Call (Vishing MFA Coercion) — SPL · unlock with TL Creds
  • Anomalous-Geolocation Sign-In or New OAuth App Authorization Following Recovery-Info Change (Valid Account Abuse Post-Takeover) — SPL · unlock with TL Creds

Indicators of compromise

As of 2026-09-25, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-2695.

5 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

The ad demanded 'NO SCRIPT READING' while printing the exact required opener, which falsely claims the call is on a 'recorded line' from Google. The Register (2026-09-25) broke the story, tying it to a broader 2025-2026 surge in vishing-as-initial-access and dark-web recruitment for social engineers.

In the August 2026 edition of its "Dark Web Roast" series, Trellix's Advanced Research Center identified a hiring post in the Telegram channel "UK Fraudsters" from a user going by "Derian" (handle @crɑick). The ad, titled "Hiring - Female/Male Mail Callers," sought USA/Canada-based applicants with a "white sounding" voice and stated in bold, "NO SCRIPT READING" — immediately followed by the exact call script applicants were required to use. That script opens: "Good afternoon, this is [name] reaching you on behalf of the Google Account Security Team on a recorded line. Am I speaking with [target name]?" (the leaked example used the name "Larry Boyles"), indicating callers are handed pre-researched target names rather than cold-dialing at random.

The scam pattern the script is built to execute is independently documented by Google itself: Google's official scam-warning FAQ (support.google.com/faqs/answer/17170932) describes callers impersonating Google Security who claim an account "has been compromised or hacked," then ask the victim to read back a verification code or approve a device/recovery prompt "over the phone" — while Google states flatly that it "will never call you about your account security." Independent technical breakdowns of this exact scam (e.g., Caldera Cybersecurity) describe the caller simultaneously triggering a genuine Google account-recovery or MFA prompt during the call so the victim receives an authentic-looking notification that appears to corroborate the caller's claims; once the victim reads back the code or approves the prompt, the attacker changes the account's recovery email and phone number, locking the legitimate owner out.

No technical network/file IOCs (phone numbers, calling infrastructure, domains, malware) were disclosed in the source reporting — this is a labor-recruitment ad for a social-engineering operation, not a leaked technical intrusion set. The find is contextualized against a documented surge: Google's own Threat Intelligence Group/Mandiant data (cited via The Register's March 2026 vishing feature and the Google Cloud Threat Horizons reporting) found voice phishing became the second-most-common initial access vector overall in 2025 (11%, versus ~8 hours-to-22-seconds initial-access handoff acceleration) and the single most common vector for cloud-environment intrusions (23%). ReliaQuest independently documented that dark-web job postings seeking English-speaking social-engineering skill more than doubled between 2024 and 2025, corroborating Trellix VP John Fokker's on-record observation of a rising trend in social-engineering job postings. The FBI's IC3 2025 Internet Crime Report (published 2026-04-07) recorded $20.87 billion in total cyber-enabled crime losses for 2025, a 26% year-over-year increase, cited by The Register as the backdrop against which this recruitment ad should be read. Google's own June 2026 fraud and scams advisory separately documents a rise in vishing/impersonation campaigns abusing official-sounding personas to coerce victims, reinforcing that voice-based impersonation of trusted brands and authorities is an active, growing consumer-fraud vector rather than an isolated incident.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1566.004 Spearphishing Voice

Persistence

T1098 Account Manipulation; T1098.005 Device Registration

Credential Access

T1111 Multi-Factor Authentication Interception; T1621 Multi-Factor Authentication Request Generation

Impact

T1531 Account Access Removal; T1657 Financial Theft

Resource Development

T1585.001 Social Media Accounts

Reconnaissance

T1589 Gather Victim Identity Information

Defense Evasion

T1684.001 Impersonation

Remediation

Patches

  • Not applicable — this is a social-engineering/labor-recruitment campaign targeting human trust and account-recovery workflows, not a software vulnerability; no vendor patch exists.

Immediate actions

  • Treat any inbound phone call claiming to be from 'Google Account Security' or a 'Google Account Security Team' as fraudulent — Google states it will never call about account security.
  • Never read a verification/recovery code or approve a device/sign-in prompt to someone who called you, regardless of how legitimate the accompanying notification looks.
  • If a suspicious call is received, hang up and independently verify account status at myaccount.google.com / the Google Security Checkup rather than continuing the call.

Workarounds

  • Enable and regularly review Google's Security Checkup for unrecognized recovery-email/phone changes or sign-in activity.
  • Set a verbal 'never share' policy for MFA codes and recovery prompts across household/organization members who may be targeted individually by name.

Longer-term hardening

  • Move high-value accounts to phishing-resistant authentication (hardware security keys or passkeys) that cannot be relayed by a caller reading back a one-time code.
  • Train users and helpdesk-adjacent staff that voice channels are now a leading initial-access vector (Google/Mandiant: ~11% of 2025 intrusions, ~23% of cloud intrusions) and should be treated with the same suspicion as email phishing.
  • Report recruitment ads and channels for criminal calling operations (e.g., via Telegram's in-app reporting) to accelerate takedown of active hiring pipelines.

Affected and fixed versions

  • Google — Google Account (consumer Gmail / Google Workspace end-user account-recovery and MFA workflow)
    Vulnerable versions: Not a software version issue — any Google Account holder reachable by phone is a potential target
    Fixed in: Not applicable — mitigated by user behavior (never share codes/approvals) and phishing-resistant authentication, not a vendor patch

Timeline

  • ReliaQuest reports dark-web recruitment/self-promotion posts already matching 2024's full-year total by mid-2025, with English-speaking social-engineering job postings more than doubling year-over-year — the recruitment trend this ad is part of.
  • Google Threat Intelligence Group / Mandiant full-year 2025 data shows voice phishing rose to the second-most-common initial access vector overall (~11%) and the top vector for cloud-environment intrusions (~23%).
  • The Register publishes a special feature, 'Voice phishing skyrockets as smooth crims talk their way in,' detailing the 2025 vishing initial-access surge and interactive social-engineering escalation.
  • FBI's Internet Crime Complaint Center (IC3) publishes its 2025 Internet Crime Report, recording $20.87 billion in cyber-enabled crime losses, a 26% year-over-year increase.
  • Google publishes its June 2026 frauds and scams advisory, documenting rising voice-based impersonation of trusted brands/authorities and citing an estimated $580 billion in global fraud losses for 2025.
  • Trellix Advanced Research Center publishes the 'Dark Web Roast – August 2026 Edition,' identifying the 'UK Fraudsters' Telegram post by 'Derian' (@crɑick) recruiting US/Canada-based callers for the Google Account Security Team vishing operation and quoting the leaked call script.
  • The Register breaks public coverage of the Trellix finding ('Fake Google Security Team ad says 'no script reading' in voice phishing - then prints the script'), tying it to FBI IC3 2025 loss figures and the ReliaQuest recruitment-doubling data.

Sources cited

Previous and next in phishing

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats