Google says it has disabled the accounts responsible for the widespread phishing email that mimicked Google Docs' design
If someone invites you to edit a file in Google Docs today, don't open it — it may be spam from a phishing scheme that's been spreading quickly this afternoon.
Context & Ripple Effects
Google's response to the Docs phishing wave starts with containment: the accounts behind the fake invite emails are disabled. The attack worked because the malicious app abused the same third-party OAuth permissions flow that legitimate Docs add-ons rely on, which is exactly the surface Google moves to harden next.
Within days Google tightened its review process for web apps requesting user data, and by July it added new security warnings for G Suite and Apps Script — both explicitly framed as follow-ups to this incident.
First-order effects
- Users who granted the phishing app access have their data exposure cut off at the source as Google disables the responsible accounts and revokes the app's reach.
Second-order effects
- Google's tightened review of web apps that request user data raises the bar for every legitimate developer in the Docs add-on ecosystem, trading faster distribution for stricter vetting.
Third-order effects
- The pattern repeats: the 2025 campaign where hackers spoofed no-reply@google.com shows that identity-based phishing keeps resurfacing even as platform-level fixes land, pushing trust decisions from users toward automated verification.
The trend: Platform providers are absorbing phishing defense into their own review pipelines — account takedowns, stricter app vetting, in-product warnings — because end-user vigilance alone has repeatedly failed.