Kaspersky Warns: New Phishing Campaign Exploits Google Tasks

Kaspersky Warns: New Phishing Campaign Exploits Google Tasks to Steal Corporate Data

Kaspersky warned of a new phishing campaign targeting company employees via Google Tasks notifications, with the aim of stealing login credentials for organizations. The messages come from the @google.com domain, making them appear legitimate and difficult for users to detect.

How Do the Fraudulent Messages Work?

Victims receive a notification titled "You have a new task" from Google Tasks, suggesting that their company has started using the tool for task management. The messages add pressure elements such as classifying the task as high priority or setting a time deadline, to make the victim act quickly and without thinking.

When clicking the embedded link, the user is redirected to a fake form titled "Employee Verification", asking for corporate account login credentials. These credentials can be used for unauthorized access to the company's systems, stealing sensitive information, or carrying out additional attacks.

A Continuing Trend of Exploiting Legitimate Platforms

Roman Dedenok, anti-spam expert at Kaspersky, said: Fraudsters exploit Google's integrated services. The campaign targeting Google Tasks is part of a continuing trend through 2026, where criminals use legitimate platforms to bypass protection filters and convince victims to act as if the message were an internal company communication.

Tips to Reduce Risks

  • Treat unexpected invitations with caution, even if they appear to come from trusted sources.

  • Check links carefully before clicking.

  • Avoid calling any phone numbers mentioned in suspicious messages, and look up official support numbers via the official website.

  • Report suspicious messages to your service provider.

  • Enable multi-factor authentication for all accounts.

Kaspersky Protection Solutions

  • Kaspersky Security for Mail Server: For business users, it provides multiple layers of defense powered by AI algorithms for comprehensive protection against advanced threats.

  • Kaspersky Premium: For individual users, it includes AI-powered anti-phishing features to improve cybersecurity levels.

Kaspersky was founded in 1997 and provides protection solutions for more than one billion devices worldwide, serving millions of individuals and approximately 200,000 corporate clients.