Cybersecurity researchers at Check Point have uncovered a large-scale phishing campaign abusing Google Classroom, turning one of the world’s most trusted educational platforms into a tool for fraud.
In just one week, attackers launched five coordinated waves, distributing over 115,000 phishing emails targeting 13,500 organizations across Europe, North America, the Middle East, and Asia.
Google Classroom, designed to connect teachers and students, was manipulated by cybercriminals who sent fake classroom invitations.
According to Check Point, instead of educational content, the messages contained commercial spam offers, ranging from reselling pitches to SEO services.
Each email then pushed recipients to contact scammers through WhatsApp numbers, a common tactic to avoid corporate security filters.
“Because the emails came through Google’s own infrastructure, many security systems initially trusted them, allowing attackers to bypass traditional email gateways. This highlights why conventional defenses alone are no longer enough,” the cybersecurity firm stated.
Check Point warns that cybercriminals are increasingly exploiting legitimate cloud services like Google Classroom to evade detection. Traditional email gateways alone are no longer sufficient to block such attacks, as hackers adapt to exploit trust in widely used platforms.
The researchers recommend that organizations:
While the attacks primarily hit Europe, North America, the Middle East, and Asia, Nigerian businesses and schools remain vulnerable given the country’s growing reliance on Google services for remote learning and workplace collaboration.
With education technology and cloud platforms rapidly expanding in Nigeria, experts warn that such tactics could easily be replicated locally to target unsuspecting users.