NCSC Switzerland: Google recovery-address abuse plus a Sites-hosted phishing page plants an app-password backdoor that survives a password reset

NCSC Switzerland (BACS) reports a fraud chain that combines abuse of a legitimate Google account-security feature with vishing and app-password persistence (NCSC Switzerland, 2026-09-22). Attackers create their own Google account, register the victim's email address as its "recovery address," then generate an app password inside their own account and label it with social-engineering text impersonating a support case: "they then generated an app password in their own account and labelled it in the free-text field with: 'Kevin W. Case-ID: 834333 To view your case…'" (translated from German; NCSC Switzerland, 2026-09-22). "Google's automated system then sent an official, technically flawless security warning to the victim. Because the naming text was automatically carried into the email, it looked to the recipient as if Google were running an urgent support case with a case handler and case number" (translated from German; NCSC Switzerland, 2026-09-22). The victim therefore receives an authentic Google security alert whose attacker-chosen label makes it read like an active support ticket (NCSC Switzerland, 2026-09-22). A follow-up vishing call from a spoofed Swiss number posing as a Google landline, which got through despite Switzerland's mid-2026 rules against spoofed Swiss numbers from abroad, then pressures the victim to resolve the "compromise" via a phishing page hosted on the legitimate sites.google.com domain rather than accounts.google.com, whose embedded form sends entered credentials directly to the attackers (NCSC Switzerland, 2026-09-22). Once inside the real account, the attacker provisions their own app password within minutes, a special access code for older applications that works without two-factor confirmation, giving persistent access that survives a subsequent password change: "as a result, the perpetrators retained access to the account even after a password change. In the reported case, emails and contacts continued to sync unnoticed to a device abroad for an extended period after the attack" (translated from German; NCSC Switzerland, 2026-09-22).

Triage: legitimate Google administrators and helpdesks never call account holders unprompted about a security case; the tell is the free-text "case ID" riding inside an otherwise-genuine Google recovery-address notification, and any login page served from sites.google.com rather than accounts.google.com (NCSC Switzerland, 2026-09-22). Detection and hardening: an app password works without two-factor confirmation and kept the attackers in the account after a password change, so BACS advises deleting every app password and checking recovery addresses and automatic forwarding rules (NCSC Switzerland, 2026-09-22). A newly created app password on an account is therefore an incident-response signal in its own right.