Scammers Are Hiding Dangerous Links Inside Google and Microsoft

Threat level

A link can come from Google Drive, Google Calendar, or Microsoft SharePoint and still take you somewhere dangerous. Google's June 2026 fraud advisory specifically called this out as one of the most actively exploited tactics right now.

Quick Summary

Scammers embed phishing links inside real Google and Microsoft documents and calendar invites
The link looks safe because it starts with a trusted domain. The danger is one click deeper
Fix: Verify unexpected links with the sender directly through a separate channel before clicking

How This Scam Works

Your email filter sees "docs.google.com" and flags nothing. Your brain trusts the familiar name. But inside that Google Doc is a button pointing to a fake login page or malware download. The same technique works with Google Calendar invites and SharePoint documents.

What To Do Right Now

1

Do not assume a link is safe because the domain looks familiar.

Where you start does not tell you where you end up. Always check the final destination.

2

Verify unexpected invites and document links.

If a colleague, vendor, or unknown contact sends you an unexpected Google Doc or calendar invite, contact that person directly by phone or a separate message before clicking. Do not reply to the same message.

3

Check the URL before entering credentials.

If a link asks you to log in, look at the address bar after the page loads. It must match the official website exactly. "accounts.google.com" is real. "accounts-google-verify.com" is not.

4

Be skeptical of urgency in shared documents.

Phrases like "immediate action required" or "your access expires today" inside a Google Doc are red flags. Real collaboration documents do not demand emergency logins.

Stay Protected Going Forward

Treat any unexpected shared document or calendar invite as suspicious until verified. The platform it comes through does not guarantee the content is safe.