There is something particularly unsettling about the latest warning from Google.
Not because Russian intelligence-linked hackers are phishing people. We have unfortunately become accustomed to that.
Not because attackers are impersonating trusted organizations. That is hardly new either.
What bothers me is something much more fundamental.
The victim can actually reach a legitimate Google or Microsoft authentication flow, successfully authenticate, and still be walking into the attack.
Think about how that feels from the user's perspective.
You receive an invitation or message that appears credible.
You click.
You see Google.
Or Microsoft.
Not a poorly constructed imitation. Not some strange login page on a domain you've never heard of.
The real authentication infrastructure.
You recognize it. You relax. You sign in.
And that feeling of relief, that moment when you think, Okay, this is legitimate, is exactly what the attacker wanted.
That should concern anyone responsible for identity security.
Because the attackers are no longer simply trying to steal our credentials.
They are learning to weaponize our trust in the systems designed to protect them.
The Login Was Real. The Trust Wasn't.
DataBreachToday reports that three Russia-linked threat clusters have been abusing legitimate Google and Microsoft authentication mechanisms in targeted espionage operations.
The campaigns have targeted relatively small groups of high-value individuals in academia, aerospace and defense, government, and think tanks in Europe and the United States.
In one campaign, victims were sent to a fake website impersonating a Finnish defense and security consultancy. They were offered access to shared documents, calendars and internal resources.
Then something very clever happened.
The site sent them through a legitimate Google sign-in page.
Only after the victim successfully authenticated were they redirected to an attacker-controlled cloud project that Google says was likely being used to steal authentication tokens and gain access to the victim's account.
Other campaigns described by Google used legitimate Microsoft OAuth links and device-code phishing. Another threat cluster sent victims through a real Google sign-in flow before redirecting them to a malicious Google Cloud project where scripts captured authentication tokens.
This isn't a story about someone foolishly typing a password into an obviously fraudulent website.
It is much more interesting than that.
And much more dangerous.
We Have Trained People to Trust the Login Screen
For years, security awareness has taught people to look for warning signs.
Check the website.
Look carefully at the domain.
Don't enter your credentials into suspicious pages.
Be careful about strange links.
Make sure the login experience looks legitimate.
All good advice.
But imagine being the person targeted in one of these campaigns.
You are busy.
You may be traveling.
You may have meetings stacked back to back.
Perhaps the message concerns something important to your work.
You click the link.
Then Google asks you to authenticate.
You've done this hundreds of times.
Nothing feels particularly alarming.
That familiarity matters.
We tend to think about cybersecurity as a technical contest between attackers and defenders.
But for the person sitting at the keyboard, it often isn't technical at all.
It is emotional.
Recognition creates comfort. Familiarity creates confidence. Confidence creates trust.
And attackers understand that.
They don't necessarily need to convince you that their fraudulent infrastructure is legitimate if they can insert legitimate infrastructure into the deception.
That is what makes this attack so interesting.
Attackers Are Attacking the Feeling of Safety
Security controls don't exist in a vacuum.
They create expectations.
When people see a familiar Microsoft login page, they feel safer.
When Google authenticates them, they feel safer.
When MFA appears, they may feel safer still.
That feeling is not irrational.
These technologies genuinely improve security.
But attackers study our expectations just as carefully as they study our technology.
If a familiar authentication experience makes us lower our guard, that experience becomes valuable to the attacker.
The attacker doesn't need to defeat our perception of trust.
They can borrow it.
That is an important evolution in phishing.
The Attacker Doesn't Need to Own the Entire Road
Imagine driving somewhere unfamiliar.
You become concerned that you may be heading in the wrong direction.
Then you see an official highway sign.
You recognize it.
You relax.
You keep driving.
But what if the highway sign itself was legitimate and you were simply being directed toward the wrong destination afterward?
The sign wasn't fake.
Your interpretation of what the sign meant was wrong.
Something similar is happening here.
The Google authentication may be legitimate.
The Microsoft OAuth flow may be legitimate.
The infrastructure may behave exactly as designed.
But the broader interaction can still be malicious.
That exposes an uncomfortable weakness in the way we think about authentication.
We Keep Asking the Same Question
For decades, authentication has concentrated primarily on one question:
Are you really you?
Password?
Prove it.
2FA?
Prove it again.
MFA?
Give me another factor.
Biometric?
Prove that you are physically present.
These controls have value.
MFA remains considerably stronger than relying on passwords alone.
But look carefully at what happened in the attacks Google describes.
The user may actually prove who they are.
And that is exactly what the attacker needs them to do.
That should cause us to rethink the problem.
Because perhaps we have been asking an incomplete question.
Who Is Authenticating Whom?
Traditional authentication is largely one-directional.
User → Destination
The destination challenges the user.
Who are you?
Prove it.
Provide your password.
Provide your token.
Approve this request.
Present your biometric.
Again and again, the burden of proof sits with the user.
But phishing attacks exploit the other half of the relationship.
The user believes they know where they are.
And that belief may be wrong.
So there is another question we need to ask:
Can the destination prove itself to the user?
That question is becoming more important as impersonation becomes easier and more convincing.
This Is Bigger Than OAuth
I want to be careful about something here.
The lesson from these attacks is not that OAuth is bad.
OAuth is enormously useful technology, and Google itself describes these campaigns as attackers abusing legitimate features and infrastructure.
The technology is being manipulated as part of a larger deception.
That distinction matters.
If we treat every new attack as simply another product vulnerability that needs patching, we miss the larger lesson.
This is a trust architecture problem.
The attacker is exploiting the assumptions surrounding authentication.
The user sees something legitimate.
The system receives something legitimate.
Yet the overall interaction can still produce an illegitimate outcome.
That is the issue we need to solve.
The Human Being Is Still Sitting in the Middle
Sometimes cybersecurity discussions become so technical that we forget there is a person involved.
Imagine discovering afterward that you were the one who authenticated.
You followed the familiar process.
You saw Google or Microsoft.
You did what you had done hundreds of times before.
Then your account was compromised.
There is frustration.
Embarrassment.
Maybe anger.
Perhaps fear about what the attacker accessed.
And inevitably someone asks: "Why did you approve it?"
That question can be unfair.
The better question is:
Why did our security architecture place so much responsibility on one human being correctly interpreting an increasingly sophisticated deception?
Attackers have an enormous advantage.
They only need the person to make the wrong decision once.
The user needs to make the right decision every time.
That isn't a particularly favorable security model.
Security Should Help People Make the Right Decision
We frequently tell employees:
Don't click.
Don't trust.
Check the URL.
Watch for impersonation.
Don't approve unexpected requests.
Don't fall for social engineering.
All reasonable advice.
But eventually technology needs to carry more of the burden.
Security should not depend on every employee becoming an expert at distinguishing increasingly sophisticated deception from legitimate business activity.
That becomes especially important as AI improves the quality of phishing, impersonation and social engineering.
The future cannot simply be:
"Train the user harder."
We need security architecture that makes deception harder to execute successfully.
This Is Why Mutual Authentication Matters
This is where Identité's patented Full Duplex Authentication® fits into the larger discussion.
Not because the world needs another authentication factor.
It doesn't.
The issue is more fundamental.
Traditional authentication primarily establishes trust in one direction:
User → Destination
Full Duplex Authentication® changes the relationship:
User ↔ Legitimate Destination
The user proves themselves.
But the destination must establish its legitimacy as part of the authentication relationship too.
That distinction matters enormously in an environment where attackers increasingly impersonate destinations.
A criminal can copy a logo.
Copy a website.
Copy language.
Copy branding.
Copy an email.
Create a convincing domain.
And increasingly, AI can help make all of those things better.
But copying what an organization looks like should not be the same as proving what that organization is.
That is the difference.
Identité Is Not Selling Another Authentication Factor
This is where I believe our industry's conversation about authentication needs to change.
When passwords became vulnerable, we added another factor.
When two-factor authentication was attacked, we expanded MFA.
When MFA became a target, we added more context, more challenges and more layers.
Again, many of these improvements are valuable.
But eventually we have to ask whether we are reinforcing the same basic architecture rather than changing it.
Identité is not selling another authentication factor. Identité is challenging the underlying one-way trust model that attackers have learned to exploit.
That is a very different proposition.
The future of authentication should not simply ask the user to prove themselves more times.
It should establish a stronger relationship between the parties involved.
Intent Is the Next Question
Destination legitimacy solves only part of the problem.
Suppose an authentication request arrives on your phone.
Did you actually request it?
That sounds obvious.
But MFA fatigue attacks demonstrate how easily that distinction can disappear.
People are busy.
Notifications arrive constantly.
Applications request authentication.
Work interrupts work.
An unexpected approval request may be mistaken for something legitimate.
So instead of merely asking:
Approve?
we believe authentication should help establish intent.
At Identité®, the user can be explicitly asked:
"Did you request this authentication session?"
Additional context, including an image and three-digit number, can help connect the authentication request to the session the person actually initiated.
Again, this isn't about adding friction.
It is about making the decision meaningful.
Am I authenticating because I intended to, or because someone else wants me to?
Those are very different things.
And Authentication Still Isn't the Finish Line
Even after we establish the legitimate user, legitimate destination and authentication intent, another question remains.
What should this identity be allowed to do?
This is where authorization becomes critical.
Authentication answers:
Who are you?
Authorization answers:
Now that we know who you are, what are you permitted to do?
Consider banking.
A customer authenticates successfully.
They check their balance. Fine.
They review transactions. Fine.
They transfer $100 between their own accounts.
Probably routine.
Then they attempt to wire $50,000 to a new recipient.
Same person.
Same account.
Same authentication.
Completely different risk.
That transaction may deserve additional authorization.
This is the difference between creating security friction everywhere and applying stronger security where the consequences justify it.
Trust Should Follow the Action
This gives us a much more complete way to think about digital trust.
Identity: Who are you?
Authentication: Can you prove it?
Destination: Is this really the organization you intended to reach?
Intent: Did you initiate this interaction?
Authorization: Should this specific action be permitted?
Context: Does what is happening make sense?
Continuous Verification: Has something changed that should cause us to reconsider trust?
That is much larger than MFA.
It is a trust architecture.
And that architecture becomes increasingly important when attackers can exploit legitimate authentication infrastructure as part of the deception.
What Happens When the Attacker Looks Legitimate?
Google's warning raises a question I believe every CISO, CIO and identity professional should consider.
What happens when the attack no longer looks like an attack?
What happens when the email is beautifully written?
When the website looks perfect?
When the person contacting you appears legitimate?
When the authentication infrastructure is real?
When the user successfully authenticates?
When nothing feels obviously wrong?
That is where security gets difficult.
And it is where relying primarily on human suspicion becomes increasingly dangerous.
Because the most sophisticated attack may not trigger fear.
It may create the opposite feeling.
Confidence.
Everything looks right.
Everything feels familiar.
So you proceed.
AI Will Make That Feeling More Dangerous
The Google campaigns described in the DataBreachToday article are sophisticated enough already.
Now consider where impersonation is heading.
AI-generated emails.
AI-generated voices.
AI-generated video.
Personalized social engineering.
Real-time translation.
Automated reconnaissance.
Highly tailored communications based on publicly available information.
The obvious mistakes that once exposed phishing will continue disappearing.
That means we should stop designing security around the assumption that people will always be able to visually or emotionally recognize deception.
The attacker of the future may look completely legitimate.
Which brings us back to identity.
Recognition Is Not Authentication
This may be one of the most important distinctions going forward.
A person can recognize a Microsoft login screen.
That doesn't establish the legitimacy of the entire interaction.
A customer can recognize their bank's logo.
That doesn't establish the identity of the destination.
An employee can recognize their CEO's voice.
Increasingly, that may not establish who is actually speaking.
We are entering an environment where:
Seeing is not necessarily believing.
Hearing is not necessarily believing.
Recognizing is not necessarily authenticating.
Security has to compensate for that reality.
The Identité Perspective: The Trust Model Has to Change
The DataBreachToday article is about Russian cyber espionage.
But I believe the lesson extends far beyond those specific campaigns.
The attacker doesn't necessarily need to defeat Google.
They don't necessarily need to defeat Microsoft.
They don't necessarily need to defeat MFA.
They don't necessarily need to break encryption.
They don't necessarily need to compromise every security layer between themselves and the target.
They need something much simpler.
They need the victim and the security infrastructure to trust the wrong thing at the right moment.
That is the deeper problem.
And that is why I believe the next evolution of authentication cannot simply be another factor.
The trust model itself needs to change.
We need to know who the user is.
We need the destination to establish its legitimacy.
We need to establish intent.
We need to authorize consequential actions.
We need to understand context.
And we need to reevaluate trust when circumstances change.
That is how we begin moving from authentication toward something much more valuable:
Digital trust.
Make Trust Harder to Counterfeit
There is a human tendency to relax when we encounter something familiar.
Attackers know it.
They exploit it.
And increasingly, they are combining legitimate infrastructure with fraudulent intent precisely because legitimacy creates confidence.
So the answer cannot simply be telling people to become more suspicious of everything.
Imagine the world that creates.
Never trust an email.
Never trust a website.
Never trust a login screen.
Never trust a phone call.
Never trust a notification.
That is not a sustainable digital economy.
People need to trust.
Businesses need trust.
Banks need trust.
Healthcare needs trust.
Government needs trust.
Digital commerce cannot function without it.
Our challenge is not to eliminate trust.
Our challenge is to make trust worthy of being trusted.
That means changing the architecture behind it.
Because attackers don't have to defeat every security control.
They only have to become someone, or something, those controls have been taught to trust.
The future of prevention begins by making that trust much harder to counterfeit.