Point researchers revealed a massive active phishing campaign exploiting Google Classroom, used by millions of students and teachers worldwide, in which the attacker released five coordinated attacks over one week, sending more than 115,000 phishing emails targeting 13,500 organizations, including education, healthcare, manufacturing, and finance, with irrelevant commercial offers from bogus classrooms.
Huge campaign abuses trusted ed tech
Check Point researchers have exposed the existence of a widespread active phishing campaign exploiting Google Classroom, the trusted tool used by millions of students and teachers around the world, according to its blog. In a matter of just one week, the attackers made five coordinated attacks, sending over 115,000 phishing emails targeting 13,500 organizations in numerous industries.
Google Classroom is a tool that allows teachers and students to stay connected by inviting them to join virtual classrooms. Malicious actors took advantage of this trust by issuing fraudulent invitations with no commercial relevance whatsoever, from product reselling pitches to SEO services. Each email was asking the recipients to call the scammers through a WhatsApp phone number, a common technique associated with fraud schemes.
The trick works because security systems, by default, trust messages that come from authentic Google services. By leveraging Google Classroom’s infrastructure, the attackers were able to circumvent certain legacy layers of security in order to try to gain access to inboxes at over 13,500 companies before any defensive actions were taken.
Back-to-school timing is most effective
According to WebProNews, the campaign delivered 115,000 phishing emails from August 6-12, 2025, to 13,500 organizations across different sectors and industries all over the globe. According to researchers, the perpetrators were advanced threat actors who set up fake Google Classroom accounts to try and emulate authentic learning environments. They invited victims to attend these counterfeit classes, and then posted phishing links disguised as assignments or resource sharing.
The attack took advantage of the back-to-school season when online classroom activity becomes high. The emails appeared innocent enough, subject lines like Join Our Study Group and New Assignment Posted alerting the victims to class invitations. Once inside, users within the fake classroom were presented with posts containing embedded links to credential-stealing pages.
Multi-layered security effectively prevents attacks
Despite how the attackers have used trusted infrastructure, Check Point Harmony Email & Collaboration SmartPhish technology automatically identified and blocked most of this phishing. However, the remaining messages were stopped by additional layers of security before reaching end users, which further indicates the need for advanced threat prevention systems.
Cross-sector targeting has a broad reach
The effects of the attack were felt in industries outside of education. Manufacturing companies were invited to phony training courses, and financial institutions were drawn to counterfeit compliance training. This cross-sector targeting is an example of how hackers are attempting to expand their reach by taking advantage of the worldwide user base of Google Classroom.
Google has admitted abuse of the system and said it is improving detection systems within Classroom, including better verification for class creations and invitations. However, the critics point out that the open architecture of the platform, which is intended to encourage collaboration, also welcomes such exploitation.
Protection advice from experts
Organizations should train users to be suspicious of unexpected invites, implement AI-based detection based on context and intent, delete email as the only channel for monitoring cloud apps, and beware – attackers are increasingly pushing victims towards off-channel communication, such as WhatsApp, to bypass enterprise controls.
As cybercriminals weaponize trusted educational platforms for mass fraud attacks, the Google Classroom phishing campaign shows there will always be new ways to take advantage of trusted services to build trust, evade defenses, and attack at scale, making multi-layered security defenses and user awareness more important than ever.
