Urgent alert for everyone with a Gmail account

A serious security alert has been issued for Google and Gmail users after researchers uncovered a new attack method being used by Russian hackers to bypass some of Google’s advanced safety features.

This latest threat was discovered by the Google Threat Intelligence Group, and targeted attacks have already occurred. While Gmail is widely known for its secure spam filters, two-factor authentication (2FA), and multi-layered protection, this breach shows that no system is fully immune — especially when older devices or alternative login methods are used.

How Did the Hackers Get In?

The attackers took advantage of Google’s “app passwords”, a lesser-known feature that generates a 16-digit code allowing access to Google services on older devices that don’t support newer sign-in methods like MFA (multi-factor authentication). These codes bypass 2FA, making them a soft target for phishing attacks.

Hackers posed as U.S. State Department representatives, inviting users — including prominent Russian critics and academics — to private consultations. Victims were tricked into creating app passwords, believing they were for secure access, but instead, they unknowingly handed over full control of their Google accounts.

Why You Should Care

Although this attack was highly targeted, experts warn that this method is now exposed and likely to be used more widely in the future — including against the general public.

How to Stay Safe

Experts at Malwarebytes and Google shared these tips to stay protected:

• Avoid app passwords unless absolutely necessary. Switch to modern apps that support stronger login methods.

• Use MFA — but choose secure options like authenticator apps or hardware security keys, not SMS.

• Stay alert for phishing — never share login codes or passwords from unexpected sources.

• Update all devices and apps regularly. Turn on automatic updates.

• Check account activity for strange logins or devices. Remove unrecognized ones immediately.

• Install security software that blocks scam sites and phishing attempts.