Check Point researchers have uncovered a large-scale active phishing campaign abusing Google Classroom, a platform trusted by millions of students and educators worldwide. Over the course of just one week, attackers launched five coordinated waves, distributing more than 115,000 phishing emails aimed at 13,500 organizations across multiple industries. Organizations in Europe, North America, the Middle East and Asia are being targeted.

Turning a Trusted Tool into a Threat Vector

Google Classroom is designed to connect teachers and students through invitations to join digital classrooms. Attackers exploited this trust by sending fake invitations that contained unrelated commercial offers, ranging from product reselling pitches to SEO services. Each email directed recipients to contact scammers via a WhatsApp phone number, a tactic often linked to fraud schemes.

The deception works because security systems tend to trust messages originating from legitimate Google services. By piggybacking on Google Classroom’s infrastructure, attackers were able to bypass certain traditional security layers, attempting to reach inboxes at more than 13,500 companies before defenses were triggered.

Figure 1: Example of a phishing email leveraging Google Classroom

Anatomy of the Campaign
  • Scale: 115,000 phishing emails sent between August 6–12, 2025
  • Targets: 13,500 organizations worldwide, spanning multiple sectors
  • Lure: Fake Google Classroom invitations with offers unrelated to education
  • Call to Action: A WhatsApp phone number, designed to move the conversation off-email and outside enterprise monitoring
  • Delivery Method: Five major waves, each leveraging Google Classroom’s legitimacy to slip past filters

Figure 2: Example of a phishing email leveraging Google Classroom

How Check Point Blocked the Attack

Despite the attackers’ sophisticated use of trusted infrastructure, Check Point Harmony Email & Collaboration’s SmartPhish technology automatically detected and blocked the majority of these phishing attempts. Additional layers of security prevented the remaining messages from reaching end users.

This incident underscores the importance of multi-layered defenses. Attackers are increasingly weaponizing legitimate cloud services—making traditional email gateways insufficient to stop evolving phishing tactics.

What Organizations Should Do
  1. Educate Users: Train employees to treat unexpected invitations (even from familiar platforms) cautiously.
  2. Deploy Advanced Threat Prevention: Use AI-powered detection that analyzes context and intent, not just sender reputation.
  3. Monitor Cloud Applications: Extend phishing protection beyond email to collaboration apps, messaging platforms, and SaaS services.
  4. Harden Against Social Engineering: Be aware that attackers increasingly push victims toward off-channel communication (like WhatsApp) to evade enterprise controls.
The Bottom Line

Attackers continue to find creative ways to exploit legitimate services like Google Classroom to gain trust, bypass defenses, and reach targets at scale. With over 115,000 emails in just one week, this campaign highlights how easily cyber criminals can weaponize digital platforms for fraud.

Recognized as a Leader and Outperformer in the 2025 GigaOm Radar for Anti-Phishing, Check Point Harmony Email & Collaboration provides the advanced, layered defense needed to secure organizations against phishing attacks — even when they hide in plain sight.

You may also like