Gmail hack alert: Google ‘warns’ 3 billion users, says they have 7-day window to recover their accounts

Gmail

Google has issued an alert for its Gmail users following a spike in account takeover attacks. The tech has warned that if a Gmail account is compromised, users will have just seven days to recover it or risk losing it permanently. The warning affects all Gmail users—over 3 billion globally—underlining the scale of the threat.
This announcement follows reports of an advanced phishing campaign that tricks users into thinking they’re interacting with official Google security messages.

What’s the security threat for Gmail users?
According to a report by Forbes, the current threat uses a combination of OAuth abuse and a workaround in DomainKeys Identified Mail (DKIM) to make phishing emails look like they are genuinely from Google. This bypasses many traditional spam and phishing protections.
In simple terms, the attackers change passwords, recovery phone numbers, and even set up passkeys to lock out the original account owner. They then gain full access to emails, personal data, and linked services, making this not just a Gmail issue, but a wider digital identity threat.

Why users should be worried
The danger lies in the sophistication of the attack. Once the account is compromised, the attacker may use AI tools and infostealer malware to spread further across a user’s digital footprint. The phishing emails are so convincing that many victims unknowingly provide credentials, giving hackers full access.
If you lose access and do not act quickly, Google may not be able to verify your identity beyond the 7-day window, especially if your recovery information has been changed by the attacker.

What should users do?
Google advises users to enable phishing-resistant authentication, like security keys or passkeys. Also, it’s essential to set up a recovery phone number and email. Even if attackers change these, the original ones can still be used for a limited period.

To add or update your recovery info:
Go to Settings → Google → Manage your Google Account → Security → Recovery options.