Skip to content
BreachPathAttack Path LibraryStart
IntermediateData theftAccount takeover

Google Workspace account to data theft

A phished Google Workspace identity is turned into durable access through a third-party app grant, then used to search Drive and Gmail for sensitive material and export it.

Technologies
Google Workspace
Entry points
Phishing, Stolen credentials
Sectors
SaaS & technology, Charity / non-profit, Professional services…
Stages
3
01

A Workspace identity is phished

The attacker lures a user to a look-alike sign-in flow and captures their credentials, and in adversary-in-the-middle style lures the active session, allowing them to act as the user.

Attacker objective

Capture a valid Google Workspace login and, ideally, the resulting session.

MITRE ATT&CK
Controls that should stop this
  • Phishing-resistant MFA (security keys / passkeys)
  • Context-aware access policies for Workspace
  • User reporting and rapid lure takedown
What defenders should see
  • Logins from new locations, devices or unusual ASNs
  • Suspicious-login alerts from the admin console
  • Session activity inconsistent with the user's norms
What a pentest validates
  • Social-engineering assessment measuring click and report rates
  • Test whether the MFA method can be relayed
  • Review context-aware access coverage
Business impact

The attacker can now act as a legitimate user within Workspace.

02

A third-party app grant establishes persistence

The attacker authorises a third-party application against the account with broad scopes, giving standing access to Gmail and Drive via a token grant rather than the password.

Attacker objective

Keep access to mail and files that survives a password change.

MITRE ATT&CK
Controls that should stop this
  • Restrict third-party app access to trusted, allow-listed apps
  • Admin review of OAuth grants and scopes
  • Revoke tokens and sessions during compromise response
What defenders should see
  • New third-party app authorisations with broad scopes
  • Token grants following a suspicious login
  • App access to mail and Drive from unusual sources
What a pentest validates
  • Test whether users can grant broad scopes to arbitrary apps
  • Enumerate existing OAuth grants for over-privilege
  • Validate response revokes tokens, not just passwords
Business impact

Persistence is decoupled from the password — a reset alone will not evict the attacker.

03

Sensitive data is located and exported

The attacker searches Drive and Gmail for sensitive terms, identifies the valuable material, and exports or downloads it — potentially via the granted app to stay less visible.

Attacker objective

Find and remove confidential documents and correspondence.

MITRE ATT&CK
Controls that should stop this
  • DLP on Drive and Gmail for sensitive content
  • Alerting on bulk download and external sharing
  • Restrict auto-forwarding to external domains
What defenders should see
  • Bulk Drive downloads or large export activity
  • New external forwarding or sharing configuration
  • Access to many documents in a short window
What a pentest validates
  • Authorised, controlled exfiltration test to check detection
  • Verify alerts on bulk download and forwarding changes
  • Confirm DLP covers the real data locations
Business impact

Confidential data leaves the tenant — a reportable breach with client-trust consequences.

ATT&CK techniques in this chain

T1078.004Valid Accounts: Cloud AccountsT1567.002Exfiltration Over Web Service: Cloud StorageT1114.002Email Collection: Remote Email CollectionT1566.002Phishing: Spearphishing LinkT1098Account ManipulationT1550.001Use Alternate Authentication Material: Application Access Token

If this chain completes

Extraction of confidential documents and correspondence from a cloud identity, with app-based persistence that outlives a password reset unless third-party access is reviewed and revoked.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths