LinkedIn AiTM phishing exposes executive Google Workspace blast radius

At a glance

What this is: This is a Push Security analysis of an executive-targeted LinkedIn AiTM phishing attack that used trusted web properties, layered redirects, and CAPTCHA to reach a Google Workspace login page.

Why it matters: It matters because compromising one SSO-linked executive account can expand access across downstream applications, making browser phishing a broader IAM and NHI governance issue.

Context

Push Security describes a targeted LinkedIn direct-message phishing attack aimed at a company executive and routed through multiple legitimate-looking pages before reaching an attacker-in-the-middle login screen. In practical terms, the problem is not just a malicious link, but an access path that intentionally avoids the controls many organisations rely on first.

For IAM teams, the important issue is blast radius. A Google Workspace compromise can expose email, chat, and other SSO-connected applications, while leaving security teams with downstream accounts, sessions, and possible persistence artefacts to investigate after the fact.

Key questions

Q: What should teams do first when an executive is targeted by AiTM phishing?

A: Preserve browser and identity telemetry before resetting anything. The first priority is to reconstruct the redirect chain, confirm whether credentials or sessions were captured, and identify which SSO-linked applications could already be exposed. Password reset alone does not answer the downstream access question.

Q: Why does LinkedIn phishing create more risk than email phishing in some campaigns?

A: LinkedIn can bypass email controls entirely and reach users in a context where external messages feel normal. When the link then uses trusted web properties and redirects, many perimeter tools lose sight of the original lure. The risk is not the channel alone, but the reduced opportunity to inspect and block it early.

Q: How can security teams tell if a phishing login page is trying to evade sandbox analysis?

A: Watch for human-interaction gates such as CAPTCHA, Turnstile, or other steps that prevent automated rendering from reaching the malicious stage. If the first page looks harmless but later requires interaction before any login prompt appears, treat that sequence as a strong evasion indicator and escalate browser telemetry review.

Q: What should IAM teams review after a Google Workspace account compromise?

A: They should review all downstream applications that trust the account through SSO, plus any integrations, tokens, or alternate login paths that may have been created quietly. The main question is not only whether the account was recovered, but whether the attacker left a second foothold elsewhere in the identity estate.

Technical breakdown

Why LinkedIn and trusted-host redirects evade email controls

This attack did not start in the mailbox, so traditional email security never had the full chain to inspect. The lure was delivered through LinkedIn, then pushed through sites.google.com, Google Search, and Microsoft Dynamics before the final AiTM page appeared. That matters because each hop hides the original source, breaks simple referrer-based checks, and makes blocklisting the seed URL far less effective. The attacker was not relying on one malicious domain surviving long enough to be detected; the chain was designed to move the user across legitimate services until the final credential capture page was reached. Practical implication: security teams need telemetry that follows browser navigation across redirects, not just inbox inspection.

Practical implication: Instrument browser and web telemetry that preserves the redirect chain so the initial lure and the final capture page can be correlated.

How CAPTCHA and bot protection defeat sandbox-based inspection

Sandbox inspection works best when a page can be rendered and analysed automatically. In this case, the attacker inserted a custom CAPTCHA challenge, which blocks many automated scanners because the page requires human interaction before the malicious content is exposed. That turns a static inspection problem into an interaction problem. Legitimate bot protection systems such as CAPTCHA and Cloudflare Turnstile are increasingly being repurposed as friction layers inside phishing flows. The result is that some tools see only a harmless first stage, while the user sees the full credential-harvest page. Practical implication: detection should not depend on fully rendering every page before policy decisions are made.

Practical implication: Treat interaction gates as a phishing signal and correlate them with suspicious redirect chains before allowing the session to continue.

Why Google Workspace compromise increases downstream SSO exposure

A Google Workspace account is not just a mailbox. It is often a federated identity anchor that can unlock chat, documents, and downstream SaaS applications through SSO. Once that account is compromised, the attacker can move from the primary identity store into adjacent apps without needing to re-phish every target. Push also notes the risk of quiet persistence through evil twin integrations, API keys, or ghost login methods after the initial compromise. That is what turns a credential theft event into an identity governance problem. Practical implication: incident handling has to include downstream application review, not just password reset and mailbox recovery.

Practical implication: Map SSO dependencies and review connected applications immediately when a primary identity account is exposed.

Threat narrative

Attacker objective: The attacker wanted executive Google Workspace access that could be used to reach downstream applications and establish persistent footholds.

1. Entry began with a LinkedIn direct message sent from a compromised executive account and framed as an investment opportunity to a high-value target.
2. The victim was pushed through multiple legitimate-looking redirects and a CAPTCHA gate before reaching an attacker-in-the-middle Google login page designed to capture credentials or a session.
3. If successful, the attacker would gain access to the executive’s Google Workspace tenant and any downstream SSO-connected applications, with scope for persistence through hidden integrations or ghost logins.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Solana web3.js npm compromise 2024: A phished maintainer's npm access let attackers publish two @solana/web3.js versions that stole private keys from bots and apps.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser-delivered phishing is now an identity governance problem, not just a mail-security problem. When the lure starts in LinkedIn and moves through trusted web properties, the control surface shifts from inbox filtering to session, redirect, and application access governance. That means identity teams need visibility into how users reach authentication pages, not just whether an email was delivered. The practitioner conclusion is simple: account compromise pathways now span browser, federation, and SSO policy.

Blast radius, not initial compromise, is the real operating metric. The executive account matters because it can open more than one application, and the article is explicit that downstream apps configured for SSO become part of the exposure set. That broadens the incident from credential theft into privilege propagation. Practitioners should therefore evaluate how quickly one identity can fan out across business-critical services.

Disposable phishing infrastructure creates an evidence problem as much as a detection problem. Push Security notes that static IoCs are of limited value because pages are rotated and often hosted on otherwise legitimate services. That means governance teams cannot rely on domain reputation alone to reconstruct exposure. The practitioner implication is that browser timelines, session traces, and authentication telemetry become core evidence sources.

Identity attack surface now includes ghost logins and evil twin persistence. The article points to stealthy persistence mechanisms such as evil twin integrations and API keys after the initial compromise. Those are not just post-breach artefacts; they are a sign that identity control planes can be quietly extended beyond the original account. The conclusion for practitioners is that account recovery without integration review leaves the compromise incomplete.

Ephemeral lure infrastructure demands continuous, browser-level detection. The campaign’s use of legitimate services, layered redirection, and CAPTCHA shows that control points earlier in the chain can be bypassed. That makes browser-based detection and response a governance signal, not a convenience feature. The field should treat this as a case where the unit of control is the active session, not the URL alone.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Identity attack surface now extends into the browser session. LinkedIn delivery, trusted-host redirects, and CAPTCHA show that the practical control point is no longer just the inbox or the IdP. Security teams should expect attackers to use legitimate services as camouflage and should validate whether browser telemetry is part of their identity monitoring stack.

Downstream access review is the critical gap after executive account exposure. The article makes clear that a single Google Workspace compromise can cascade into many SSO-linked applications, which turns recovery into a governance exercise as much as an incident response task. Teams need a repeatable way to enumerate connected apps, sessions, and persistence artefacts as soon as a primary identity is touched.

For practitioners

• Instrument browser-level detection for AiTM phishing Monitor the full navigation chain inside the user session so redirect hops, CAPTCHA gates, and final login destinations can be correlated in one timeline.
• Hunt for executive access to the lure chain Look for executive-level users who visited linked combinations of sites.google.com, Microsoft Dynamics, and the final phishing domain within a short time window.
• Review SSO-connected downstream applications after account exposure Inventory SaaS apps federated to the exposed Google Workspace account and verify whether tokens, sessions, or hidden integrations were created.
• Check for stealth persistence mechanisms Search for ghost login methods, evil twin integrations, and API keys that could survive password reset or mailbox recovery.

Key takeaways

• This campaign demonstrates that browser-mediated phishing can defeat controls built around email, reputation, and static URL blocking.
• An executive Google Workspace account can become a broad access pivot because downstream SaaS applications often trust the same identity.
• The limiting control is not only phishing detection but rapid enumeration of SSO links, sessions, and persistence paths after exposure.

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Ghost Login: A ghost login is a direct authentication path that remains active after an organisation believes it has moved to central single sign-on. It creates a parallel trust model that can still accept passwords, so the identity team sees one policy posture while attackers exploit another.
• Evil Twin Integration: An evil twin integration is a malicious duplicate of a legitimate integration created to preserve access after compromise. It often blends into normal SaaS administration, which makes post-incident review essential because the attacker may no longer need the original credential to regain entry.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.