AppSheet Abuse Fuels Global Job Scam and Phishing Surge

Global cybersecurity firm Kaspersky has identified a large-scale phishing and cyberattack campaign that exploits the legitimate features of Google’s AppSheet platform to distribute fake job offers impersonating well-known multinational companies. In a research report released on Sunday, June 7, the company revealed that cybercriminals are sending fraudulent recruitment-related emails under the names of major corporations such as Google, Meta, Apple, Coca-Cola, and Volvo. The primary objective of the scheme is to steal users’ personal information as well as login credentials for social media and Google accounts.

According to Kaspersky’s cybersecurity researchers, the attackers are leveraging Google’s own infrastructure to send phishing emails from the address [email protected]. Because the messages originate from a legitimate Google domain, they appear highly trustworthy and can bypass common email security mechanisms such as SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting and Conformance).

The emails contain links that redirect recipients to carefully crafted counterfeit websites designed to mimic legitimate recruitment portals. Users are then prompted to submit personal and sensitive information. In some cases, the attackers are also exploiting AppSheet’s automated messaging capabilities to distribute phishing links through SMS messages.

The investigation found that the criminals require only a paid AppSheet subscription to establish these phishing operations, making it relatively easy for them to gain the trust of potential victims. Commenting on the abuse of trusted technology platforms, Kaspersky Senior Spam Analyst Anna Lazarevich warned:

“Popular and trusted online services are increasingly becoming tools for cybercriminals. Previously, we observed phishing campaigns using Google Forms and Google Tasks, and now AppSheet is being used for the same purpose. Users should not automatically trust an email simply because it originates from a reputable domain.”

Security Recommendations for Users

To protect against such cyber threats, Kaspersky has issued several recommendations for internet users. The company advises individuals to verify any unexpected job offer or recruitment-related email directly through the official website or verified communication channels of the organization concerned before taking any action.

Users are also urged to:

• Avoid clicking on links from unknown or unverified sources.
• Enable strong two-factor authentication (2FA) on their accounts.
• Use reputable antivirus and security software to detect and block malicious activity.

In addition, Kaspersky recommends that corporate organizations conduct regular phishing-awareness training for employees and deploy advanced email security solutions such as Kaspersky Mail Gateway to strengthen protection against increasingly sophisticated phishing attacks.

DBTech/SS/MI/OR