NCSC Switzerland: Google recovery-address abuse plus a Sites-hosted phishing page plants an OAuth app-password backdoor that survives a password reset

NCSC Switzerland (BACS) reports a fraud chain that combines abuse of a legitimate Google account-security feature with vishing and app-password persistence. Attackers create their own Google account, register the victim's email address as its "recovery address," then generate an app password inside their own account and label it with social-engineering text impersonating a support case: "they then generated an app password in their own account and labelled it in the free-text field with: 'Kevin W. Case-ID: 834333 To view your case…'" (translated from German; NCSC Switzerland, 2026-09-22). "Google's automated system then sent an official, technically flawless security warning to the victim. Because the naming text was automatically carried into the email, it looked to the recipient as if Google were running an urgent support case with a case handler and case number" (translated from German; NCSC Switzerland, 2026-09-22). Google's recovery-notification email is itself genuine and unmodifiable by the attacker except for that free-text label, so the victim receives an authentic Google security alert that reads like an active support ticket. A follow-up vishing call from a spoofed Swiss-looking number (surviving Switzerland's mid-2026 anti-spoofing rules for foreign-originated calls) then pressures the victim to resolve the "compromise" via a phishing page hosted on the legitimate sites.google.com domain rather than accounts.google.com, which relays entered credentials to the attacker in real time. Once inside the real account, the attacker immediately provisions their own app password (a legacy credential type that bypasses two-factor authentication) giving persistent access that survives a subsequent password change: "as a result, the perpetrators retained access to the account even after a password change. In the reported case, emails and contacts continued to sync unnoticed to a device abroad for an extended period after the attack" (translated from German; NCSC Switzerland, 2026-09-22).

Triage: legitimate Google administrators and helpdesks never call account holders unprompted about a security case; the tell is the free-text "case ID" riding inside an otherwise-genuine Google recovery-address notification, and any login page served from sites.google.com rather than accounts.google.com. Detection and hardening: audit and restrict app-password issuance on any Google account, and treat an app-password creation event with the same sensitivity as a new OAuth grant for incident-response purposes, since it is a durable, MFA-bypassing credential that a full password rotation does not revoke.