How Google Cloud Users Can Combat Coronavirus-Themed Phishing Emails

This article is based on reporting originally published by TechRepublic and a Google blog post from April 2020. Some statistics cited below reflect conditions at that time.

COVID-19 as a Cybersecurity Threat Vector

During the COVID-19 pandemic, cybercriminals rapidly pivoted to exploit widespread anxiety about the disease. Phishing campaigns using coronavirus-themed lures became one of the most common attack vectors, targeting individuals and organizations alike. Google Cloud services — including Gmail, G Suite, and Chrome — became prime targets given their enormous user bases.

Google outlined both its own defensive measures and actionable guidance for administrators and end users to reduce exposure to these threats.

The Scale of the Problem

To understand why Google-level defenses matter, consider the volume of malicious traffic Gmail handles:

• Gmail blocks more than 100 million phishing emails every day, according to Google.
• In the week following Google’s April 2020 blog post, Gmail was hit with 18 million pieces of COVID-19-related malware and phishing emails.
• More than 240 million coronavirus-themed spam messages were being sent to Gmail users daily at peak.
• Google reported that 99.9% of spam, phishing, and malicious messages are stopped before reaching user inboxes.

The sheer volume of pandemic-themed attacks helped Google’s machine learning systems build better detection models — a rare silver lining of a damaging threat wave.

Common COVID-19 Phishing Tactics

Attackers used several recurring themes in coronavirus-related phishing campaigns:

• WHO impersonation: Emails impersonating the World Health Organization to solicit fraudulent donations or deliver malware.
• Remote work lures: Messages targeting employees newly working from home, often posing as IT support or VPN instructions.
• Government stimulus packages: Emails referencing small business relief funds to trick recipients into providing credentials or financial information.
• Stay-at-home order alerts: Fake official notices aimed at organizations adjusting to lockdown restrictions.

A key technique across all these campaigns is brand impersonation — making a malicious email look like it comes from a trusted authority (a government body, the WHO, or a familiar software vendor).

What Google Is Doing at the Platform Level

DMARC Implementation with the WHO

To combat WHO impersonation, Google worked directly with the World Health Organization to help implement DMARC (Domain-based Message Authentication, Reporting, and Conformance). DMARC is an email authentication protocol that lets domain owners specify how receiving mail servers should handle messages that fail SPF or DKIM checks. By hardening the who.int domain with a strict DMARC policy, it becomes significantly harder for attackers to send email that convincingly appears to come from that domain.

Safe Browsing API Integration

Any newly identified threat — malicious URL, malware distribution site, or phishing page — is fed into Google’s Safe Browsing API, which is shared across Gmail, Chrome, and other Google products. Safe Browsing warns users before they navigate to a flagged site or download a dangerous file, providing a cross-product defense layer.

Advanced Phishing and Malware Controls for G Suite

For G Suite (now Google Workspace) customers, Google automatically enables advanced phishing and malware controls. These controls analyze inbound messages for suspicious signals and then take one of three automated actions:

• Display a warning banner inside the email client
• Route the message to spam
• Quarantine the message for administrator review

What G Suite Administrators Should Do

Platform-level defenses are a starting point, not a complete solution. G Suite administrators should take the following steps:

• Review Google’s advanced phishing and malware protection settings in the Admin Console and confirm that recommended controls are enabled for your domain.
• Enable the security sandbox for G Suite, which executes suspicious email attachments in an isolated environment to detect previously unknown malware before it reaches users.
• Audit DMARC, SPF, and DKIM records for your own domain to prevent attackers from spoofing your organization’s email address to target your employees or partners.
• Monitor the Admin Console security dashboard for anomalies such as unusual login locations, large volumes of outgoing mail, or elevated quarantine counts.

What Individual Users Should Do

End users are the last line of defense. Google recommends the following practices:

• Complete a Security Checkup at myaccount.google.com/security-checkup to review connected apps, recent security events, and account recovery options.
• Avoid downloading unrecognized file attachments. Instead, use Gmail’s built-in document preview to inspect files without downloading them — this prevents malicious executables from running locally.
• Inspect URLs carefully before clicking. Phishing URLs often mimic legitimate domains by adding extra words, subdomains, or character substitutions (e.g., who-health.org instead of who.int). Hover over links to see the real destination before clicking.
• Report phishing emails using Gmail’s built-in reporting tool (the three-dot menu → “Report phishing”). This improves detection for all users.
• Enroll in Google’s Advanced Protection Program if you or your organization are at elevated risk (executives, IT staff, journalists, activists). Google stated that no enrolled user had been successfully phished at the time of the blog post, even when repeatedly targeted.

Understanding DMARC: A Quick Primer for DevOps Teams

If you manage DNS and email infrastructure for your organization, implementing DMARC correctly is one of the highest-impact steps you can take to prevent email spoofing. The three layers work together:

• SPF (Sender Policy Framework): A DNS TXT record that lists the IP addresses authorized to send email on behalf of your domain.
• DKIM (DomainKeys Identified Mail): Cryptographically signs outgoing messages so recipients can verify they haven’t been tampered with in transit.
• DMARC: Sits on top of SPF and DKIM. It tells receiving servers what to do when a message fails authentication — none (monitor only), quarantine, or reject — and provides aggregate reports so you can see who is sending email claiming to be from your domain.

A basic DMARC DNS record looks like this:

_dmarc.yourdomain.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com"Code language: JavaScript (javascript)

Start with p=none to collect reports without affecting mail flow, then move to quarantine or reject once you’ve confirmed all legitimate sending sources are covered.

Key Takeaways

Crisis events consistently produce spikes in phishing activity because attackers exploit urgency and uncertainty. The COVID-19 pandemic was an extreme example, but the defensive principles apply to any themed phishing wave:

• Platform-level controls (Safe Browsing, advanced phishing filters) reduce bulk threats but cannot catch everything.
• DMARC authentication at the domain level prevents your brand from being weaponized against your own users and partners.
• User education and easy reporting mechanisms are essential complements to technical controls.
• High-risk users should use hardware security keys and enroll in advanced protection programs.