How can we contain an automated Google Workspace AiTM phishing campaign?

Move quickly, but preserve evidence first where possible. Export relevant login, OAuth, admin, mail, and alert logs before making broad changes, then use them to identify affected accounts and persistence mechanisms. Revoke suspicious OAuth tokens, terminate sessions, reset passwords, inspect forwarding and delegation settings, and continue monitoring after remediation. Workspace support should be involved immediately because provider-side investigation may be necessary.

Calendar invitations deserve special attention. Malicious events may appear on a user’s calendar even when the related email is filtered as spam, and the event description can contain the phishing link. Review the Google Calendar invitation controls and consider allowing invitations to be added automatically only after the user has responded by email. Also warn users not to trust unexpected calendar events.

An AiTM attack can steal an authenticated session even when the user completes two-step verification, so shortening sessions and disabling trusted devices may reduce exposure but will not eliminate the underlying risk. Strong phishing-resistant, passwordless authentication—such as security keys or passkeys—is a much better long-term defense. During an incident, revoke sessions and OAuth grants, reset credentials, review account changes, and monitor for newly created forwarding rules or suspicious applications.

The “worm” is essentially an automated propagation loop: compromised accounts send convincing phishing messages, other users sign in through the attacker’s proxy, and those accounts are then used to continue the campaign. That can make the activity look like many unrelated compromises when it is actually one constantly expanding chain.