NordVPN research: A fake voicemail email can hijack your Google account

The attack starts with a voicemail that looks routine

The attack starts when a target receives an email that looks like a Google Voice voicemail notification. The message can appear convincing because attackers send it from previously compromised legitimate accounts. That tactic helps the email pass sender authentication checks such as SPF, DKIM, and DMARC, which verify whether an email appears to come from an approved domain.

The fake email includes a tracking link through SendGrid, a legitimate email delivery service. After the target clicks the link, they land on a fake Google Voice page.

The button only works if the visitor arrives from the phishing email through the SendGrid tracking link with the right campaign string attached. After the platform confirms that path, it redirects the target to the next stage of the attack.

A fake subscriber page asks for push notification access

Before the login theft begins, the target may see a page that asks them to enable browser push notifications. The page uses a fixed subscriber count to make the prompt seem popular and safe.

If the target allows notifications, the page can show a “Subscription confirmed” message. At that point, the attacker has a persistent way to reach the browser later. Criminals can use that channel for future scams, even if the target doesn’t complete the Google login step.

The platform blocks many automated security checks

Before the platform shows the phishing page, it requires the visitor to pass a Cloudflare Turnstile check. Cloudflare Turnstile is a website security tool that helps site owners separate human visitors from automated bots. Legitimate websites use it to reduce spam and abuse.

In this campaign, attackers use Turnstile for the opposite purpose. The check helps them block automated analysis by scanners, sandboxes, and security tools.

During NordVPN’s analysis, scripted access attempts failed. The platform likely ended sessions after it flagged automated access. Because automated tools could not reach the final phishing page, we confirmed that stage through a separate manual browsing session. Scanners and sandboxes may therefore see a harmless page or no useful content, while a legitimate target can still see the live phishing session.

The Google login is real

After a visitor passes the platform’s checks, the attack moves to the Google login stage. That’s where the campaign becomes harder to spot. Most phishing advice tells people to look for spelling mistakes, broken layouts, or awkward logos. That advice doesn’t help much against this platform.

The phishing platform uses a browser-in-the-middle technique, which places the attacker’s server between the target and the real website. In this case, the server opens the genuine Google login page and streams it to the target’s screen.

The page behaves like Google because Google’s actual login flow is running in the attacker-controlled browser. Buttons, hover effects, and navigation all work as expected.

The address bar is the clue. The page does not run on a Google domain. The research identified onverinusinesscommunicationscente.org as the attacker-controlled domain.

The browser tab also uses the title “Secure browser session” instead of “Google.” That title may look harmless during a quick glance at open tabs, but it’s a warning sign.

The attacker captures both the session and the password

The fake site starts a dedicated session for each target. It loads a JavaScript file that mirrors the real Google page inside the target’s browser. Every click and keystroke goes to the attacker’s server first. The server then applies those actions to the real Google page.

If the target enters an email address, password, or one-time two-factor authentication code, the attacker captures it in real time. The criminal then uses the code immediately in the real Google session.

After the login succeeds, the attacker can capture the authenticated session. That session can include stolen cookies or tokens that keep the account logged in.

That’s why standard 2FA codes sent by app or SMS can’t stop browser-in-the-middle phishing. The criminal doesn’t need to guess or reuse the code later because they relay it at the same time as the target enters it.

A human can guide the attack in real time

The platform includes an operator panel that lets a human attacker watch the target’s session live. The operator can stay in view-only mode or request control of the session.

That live control makes the attack more flexible. If the first login attempt fails, the operator can react. If Google asks for a second factor, the operator can wait for the code and move the session forward.

The platform also supports recovery-code capture. Recovery codes are backup codes that help users regain account access when the usual second factor is not available. If attackers capture those codes, they can use them to bypass future login checks.

The session tokens include project and campaign identifiers, which suggests a phishing-as-a-service model. In plain terms, one criminal group may run the platform while other criminals use it to run separate campaigns.

Why corporate employees need to pay attention

The campaign first stood out because it targeted CEOs and senior executives at major companies. Further evidence showed that the emails reached employees across whole organizations.

A phishing email doesn’t need to reach the CEO to create damage. A Google account used for work can hold shared files, internal emails, calendar invites, vendor messages, and password reset links. If attackers compromise that account, they can use it to open company files, read internal messages, and reset passwords for other workplace tools.

For executives, the damage may be more severe. A hijacked Google account can expose board communications, contracts, confidential documents, and payment discussions. Attackers can also impersonate the executive to request transfers or sensitive data from employees — a tactic known as CEO fraud.

Corporate accounts are the main concern, but anyone with a Google account can be a target. A personal account can still hold private emails, photos, files, receipts, and password reset messages for other services.

How to spot the Google Voice voicemail scam

Page design alone won’t protect you because this fake flow can show the real Google login page. Focus on the signs attackers can’t fully control:

• You receive an unexpected Google Voice voicemail email.
• The sender appears familiar, but the message seems out of context.
• The link sends you through a tracking URL or an unfamiliar domain.
• The address bar shows an unfamiliar domain instead of accounts.google.com or another official Google domain.
• The browser tab says “Secure browser session.”
• The page asks you to accept push notifications.
• The page uses popularity claims, such as a subscriber count, to pressure you.

What to do if you receive a suspicious Google Voice voicemail email

Treat unexpected voicemail notifications with caution, even if the message appears to come from someone you know. Attackers can send phishing emails from compromised accounts, so a familiar sender doesn’t make the message safe.

Before you open the link:

1. 1. Check whether you expected a voicemail.
2. 2. Contact the sender through a separate channel if the message seems unusual.
3. 3. Preview the link destination — don’t open links that lead to unfamiliar domains.

If you already opened the link:

1. 1. Check the address bar before you type your Google password.
2. 2. Don’t allow browser push notifications.
3. 3. Close the page if the domain doesn’t look like an official Google domain.
4. 4. Tell your IT or security team if you use a work account.

If you entered your Google password or one-time 2FA code on a suspicious page:

1. 1. Change your Google password immediately.
2. 2. Sign out of all active Google sessions.
3. 3. Review your account recovery options.
4. 4. Remove unknown devices from your Google account.
5. 5. Tell your IT or security team if you use a work account.

Tip: Use a phishing-resistant login where possible

Passkeys and hardware security keys offer stronger protection against browser-in-the-middle phishing than one-time 2FA codes. A passkey only works on the legitimate website it was created for, not on an attacker-controlled domain. A hardware security key works in a similar way.

A criminal can relay a one-time code through their server, but they can’t complete a passkey login for the wrong domain in the same way. If your workplace supports passkeys or hardware security keys, use them for Google Workspace and other important accounts.

Security tools can also add another layer of protection. NordVPN’s Link Checker lets you inspect suspicious URLs manually before you open them, while the next-gen antivirus tool can check URLs automatically as you browse and help block malicious websites and malware.

NordVPN’s next-gen antivirus also includes email protection, which checks embedded links in emails for phishing, malware, and other online threats. It works in real time across the Gmail and Yahoo Mail web interfaces by scanning visible links in the email you’re viewing. If a link looks suspicious, the tool flags it on the page, so you’re less likely to click a malicious link in a phishing email.

Still, no tool replaces careful checks. In this case, the login page was real but used by scammers. The address bar was the giveaway. Always treat unexpected voicemail emails with suspicion, check the full domain before you type your password, and switch to a phishing-resistant login wherever you can.

Disclaimer: The trademarks referenced are for illustrative purposes only. NordVPN is not affiliated with, sponsored by, or endorsed by the owners of those trademarks.

Methodology

NordVPN’s Threat Intelligence team reconstructed the full attack chain using technical artifacts collected during observation sessions. These artifacts included screenshots, network captures, JavaScript code, and service workers.

The team used browser automation tools and manual inspection to map the redirect flow from the initial lure domain to the final Google credential phishing gateway. Analysts also decoded session tokens and examined the platform’s client-side code to assess how the phishing kit works.