Google Emergency Warning Gmail: Reset passwords and Enable passkeys

---

Introduction

Google Emergency Warning Gmail users: after data taken from a third-party service began helping scammers. The stolen business contact details have made phishing emails and fake phone calls more convincing. Google says its core systems were not hacked, but the situation still raises the risk of account takeovers. Act now to protect your account.

Why this matters

Scammers are using real company contact details and phone calls to trick people into giving passwords or codes. That means even careful users can be fooled. Simple steps like using passkeys and running Google’s Security Checkup can stop most attacks.

What happened — short version

Threat actors stole contact data from a Salesforce-related integration. That data made phishing messages and vishing calls more believable. Google has taken steps to block the affected connections and told admins what to do. Google says Gmail and Workspace were not broadly breached.

How attackers are working

Scammers mix email phishing with phone calls (vishing). They may:

• Send an email that looks real and asks you to log in.
• Call and pretend to be support staff asking for a code.
• Use fake sign-in pages or stolen tokens to get into accounts.

These combined tricks make it easier for attackers to break in.

What to do right now (simple steps)

1. Run Google Security Checkup. Check devices, apps, and recovery details in your Google account.
2. Use passkeys if possible. Passkeys are safer than passwords and harder to phish.
3. Turn on non-SMS 2-step verification. Use an authenticator app or a hardware key — not SMS.
4. Change weak or reused passwords. Use a password manager to create and save strong passwords.
5. Ignore unexpected calls asking for codes. Google will not call and ask for your sign-in codes. Hang up and check your account settings instead.

Google said it revoked the affected OAuth tokens and disabled the risky integration while it investigates. That helps stop attackers from using those stolen tokens.

How to spot a fake message or call

• If a caller asks for a code or password, end the call and check your account settings.
• Check the sender’s email carefully. Real Google emails come from official Google domains.
• Don’t click links in unexpected emails. Open your Google account directly at myaccount.google.com.

What’s our thought (author)

People with reused passwords, weak 2-step verification, or many third-party app connections are at higher risk. Business contact lists make phishing more targeted, so workers who use shared CRMs or shared contact systems should be extra careful.

Frequently Asked Questions

Conclusion

Even if Google’s main systems are safe, data stolen from other services can help scammers. Running Security Checkup, switching to passkeys, and avoiding phone or email requests for codes are quick steps that cut your risk a lot.

Suggested Posts:

---