Few of Google's public warnings have carried the weight of the fraud and scams advisory it released in June 2026. The company pegged global fraud losses at a staggering $580 billion for 2025 and reckoned that roughly one adult in five had been in an attacker's crosshairs. Buried among those numbers was a warning pointed squarely at your inbox: three new Gmail scams are now defeating defenses that stood firm for years — the two-factor authentication you trust most among them. The clumsy "Nigerian prince" appeals are history. These operations lean on AI, wear a professional gloss, and are engineered to impersonate the very Google services you touch every day.
What follows breaks down each of the three threats Google flagged, lists the tells worth memorizing, and gives you a working checklist for locking your account down. It doesn't matter whether you manage a single personal inbox or run dozens of aged Gmail accounts for outreach — understanding the 2026 Gmail scams landscape is now table stakes.
Inside Google's June 2026 Scam Advisory
Google issues fraud advisories periodically to flag rising attack patterns to its roughly two billion Gmail users. Two things made the June 2026 edition stand out: how far it reached, and how precise it got. Instead of leaning on the usual "watch out for phishing" boilerplate, Google named specific techniques its own threat researchers had tracked spreading in the wild — and it admitted, plainly, that several of them cut straight through the multi-factor authentication most people believe protects them.
The numbers underneath were sobering. Worldwide fraud losses reached an estimated $580 billion in 2025. Researchers recorded a 1,210% jump in AI-assisted fraud tooling year over year, and in controlled tests roughly 60% of participants fell for AI-generated phishing messages — nearly matching the success rate of messages hand-crafted by skilled human attackers. The takeaway is stark: the sheer volume, the finish, and the personalization of modern Gmail scams have all climbed together.
Three techniques were singled out as aimed at Gmail and Google account holders: Adversary-in-the-Middle (AiTM) phishing, calendar invite phishing, and ClickFix fake update lures. Each targets a different corner of your trust — the way you sign in, the way you keep a schedule, and the reflex to click "update now." We'll dismantle all three in turn.
Why Gmail Scams Turned More Dangerous in 2026
For most of email's existence, the weakest link in any phishing attempt was the writing itself. Typos, broken grammar, and awkward phrasing gave the game away. Generative AI erased that tell overnight. In seconds, a scammer can now produce a flawless, precisely localized email — or a pixel-perfect clone of a sign-in page — and then season it with details harvested from a data breach.
Three forces converged to make 2026 a breakout year for Gmail scams:
- AI-generated content — Phishing emails, fake support pages, and even voice calls (vishing) now ship at scale with none of the linguistic slip-ups that once exposed them.
- Phishing-as-a-Service (PhaaS) kits — Ready-made toolkits like the Tycoon family give low-skill criminals the means to run sophisticated AiTM campaigns for a monthly fee.
- Massive credential leaks — In one 2026 breach, roughly 48 million Gmail logins surfaced within a 96 GB exposed database packed with credentials from countless services. Leaked passwords are the raw material for targeted, personalized attacks.
All of which means the old advice — "look for typos, don't click strange links" — has run out of road. This new generation of Gmail scams reads clean, shows up with context, and is designed to walk you through steps that feel completely normal. That's exactly why Google decided it had to name them.
Threat 1: Adversary-in-the-Middle (AiTM) Phishing
Of the three Gmail scams, Adversary-in-the-Middle is the most technically alarming, because it beats two-factor authentication — the safeguard most people treat as the last line of defense.
Picture how an AiTM attack unfolds. An email lands looking like it's from Google, your bank, or a shared-document notification. You click the link and reach a sign-in page identical to the real one. But this page is a malicious proxy sitting between you and the genuine service. As you type your password, the proxy forwards it to the authentic site in real time. When that site requests your 2FA code, the proxy relays the prompt to you, you enter it, and the proxy passes that along too. The login succeeds — everything appears to "work."
Here's the trap. While your own hands complete the real two-step prompt, the attacker quietly captures the session cookie the legitimate service hands out after login. That cookie is what keeps you signed in. With it, the attacker walks in right behind you and stays authenticated on their own device — never needing your password or a 2FA code again. That's why AiTM is called an "MFA bypass": it doesn't crack your second factor, it steals the reward that the second factor was supposed to protect.
Why it works so well: nothing looks visually wrong. The login flow behaves as it should, the 2FA prompt is real, and the sole giveaway is the URL — which AiTM kits bury under look-alike domains and layers of redirects. Once an attacker holds your session, they can read your mail, reset passwords across your other accounts, and pivot to your contacts. If your account is taken over this way, our guide to recovering a Gmail account maps out the emergency steps.
Threat 2: Calendar Invite Phishing
The second named Gmail scam is clever precisely because it bypasses your inbox entirely. Calendar invite phishing takes advantage of Google Calendar's ability to automatically place events from incoming invitations onto your schedule.
An attacker sends a calendar invite — often as an .ics file — carrying a fake "subscription renewal," "payment failed," or "security review required" notice. Since many calendars are set to add invitations automatically, the event simply appears on your schedule, reminder and all. The psychological trick is powerful: a calendar entry feels like something you created or agreed to, not something a stranger planted in front of you. When the reminder fires, it carries a link to a phishing form — and you're much more likely to trust it.
There's a structural reason this vector lands: the .ics format historically hasn't been treated as a threat by email security platforms, so these invites frequently sail past filters that would catch a normal phishing email. Attackers also attach QR codes to calendar invites ("scan to confirm your meeting"), steering you onto your phone — a device with lighter security tooling — to complete the AiTM sequence described above.
The good news: this threat has a clean structural fix. Google recommends turning off automatic event creation from invitations, so only the events you deliberately accept ever reach your calendar. We spell out the exact setting in the protection section below.
Threat 3: ClickFix Fake Update Lures
ClickFix is the newest and fastest-growing of the three Gmail scams, and it weaponizes your instinct to fix a small problem. At its core it's a malware lure disguised as ordinary maintenance.
Typically the attack begins with an email link that sends you to a convincing page — frequently hosted on a legitimate-looking Google Sites or cloud-document address to slip past reputation filters. The page announces that a browser update, a CAPTCHA check, or a "human verification" is required, then guides you through copying and pasting a command into a system dialog, or running a small download. That "fix" is the infection. The pasted command silently installs an infostealer that vacuums up passwords, cookies, and crypto wallets straight from your machine.
Throughout 2026, ClickFix campaigns multiplied fast, arriving with new malware loaders and fresh disguises — bogus Windows updates, bogus macOS utilities, bogus document-verification prompts. Because the victim carries out the installation personally, antivirus software and email filters routinely miss it.
The defense comes down to a single line worth memorizing: no legitimate website ever asks you to paste a command into your terminal, the Windows Run box, or any system setting to "verify" yourself. If a verification step instructs you to leave your browser and run something, it isn't a CAPTCHA — it's a ClickFix attack. Close the tab.
The Three Threats Side by Side
Here's how the three Gmail scams from Google's June 2026 advisory compare — what each one is after, and how you shut it down:
| Threat | What It Targets | Key Tell | Primary Defense |
|---|---|---|---|
| AiTM Phishing | Your login session (steals cookies, bypasses 2FA) | Login URL is a look-alike domain | Passkeys + Advanced Protection |
| Calendar Invite Phishing | Your schedule and your trust | Event you never accepted appears | Disable auto-add of invites |
| ClickFix Fake Updates | Your device (installs infostealer malware) | Asked to paste a command or "verify" outside the browser | Never run pasted commands |
Notice the shared thread: each of these Gmail scams asks you to do something that looks small and routine — sign in, glance at an event, clear a verification. The danger hides inside an action that feels entirely ordinary, and that's precisely what makes them far harder to catch than old-school spam.
Warning Signs Every Gmail User Should Memorize
Because the new Gmail scams are so visually polished, spotting sloppy grammar is no longer a reliable filter. Train yourself instead to react to behavioral red flags — the things a legitimate service would simply never ask of you:
- Urgency and threats — "Your account will be suspended in 24 hours," "payment failed, act now." Real providers rarely hang panic deadlines over you.
- A login page reached by clicking an email link — Type
mail.google.comyourself instead of clicking through. AiTM hides in that click. - Any instruction to paste a command or open a system dialog — The signature of ClickFix. No legitimate version of this exists.
- Calendar events you don't remember accepting — Especially anything about money, security, or deliveries.
- QR codes in emails — "Scan to verify" pushes you onto a less-protected phone. Treat QR codes in unsolicited messages as hostile.
- Look-alike domains —
google-secure.com,gmail-support.net, and their relatives are never Google. The real domain isgoogle.com. - Requests for your 2FA code over the phone or in chat — Google will never call and ask you to read out a code.
The moment even one of these flags appears, stop and verify through a channel you already trust. A lot of these same instincts overlap with the broader habits in our Gmail account security tips guide — well worth reading alongside this advisory.
How to Protect Your Gmail Account in 2026
Spotting the threats is only half the battle; the other half is hardening your account so that even a phishing attempt that lands walks away empty-handed. Here's a prioritized checklist built to counter all three of the Gmail scams Google named.
1. Switch to passkeys (the single biggest upgrade). Passkeys are phishing-resistant by design. Because they're cryptographically bound to the genuine Google domain, a passkey simply won't authenticate on an AiTM proxy page — the look-alike domain doesn't match, so the login fails. That neutralizes the most dangerous of the three threats at the root.
2. Enroll high-value accounts in Google Advanced Protection. Advanced Protection requires hardware-backed sign-in and blocks the cookie theft that powers AiTM attacks. Google is also rolling out Device Bound Session Credentials, which tie a session cookie to the device that created it — rendering a stolen token worthless on the attacker's machine.
3. Turn off automatic calendar invites. In Google Calendar settings, open Event settings and change "Add invitations to my calendar" to "Only if the sender is known" (or "When I respond to the invitation in email"). This one toggle closes off calendar invite phishing by ensuring nothing reaches your schedule without your say-so.
4. Commit to one unbreakable rule against ClickFix. Never paste a command, open the Run box, or launch a downloaded "verification" tool just because a web page told you to. Burn this into memory: CAPTCHAs live inside the browser, never outside it.
5. Use a password manager with domain matching. A good password manager autofills credentials only on the exact domain it saved them for. If it refuses to autofill on a "Google" login page, that refusal is a loud warning that the page is fake.
6. Run a Security Checkup every quarter. Visit your Google Account's Security Checkup to review connected devices, third-party app access, and recovery options. Revoke anything unfamiliar. If you ever get locked out or flagged, our guides on fixing a suspended Gmail account and recovering access make a useful next stop.
7. Keep your recovery details current. An up-to-date recovery phone and email sharply cut the time it takes to reclaim control after a compromise — and they reinforce automated trust signals, which also benefits your long-term deliverability and account standing.
What These Gmail Scams Mean for Businesses
For individuals, the new Gmail scams are a personal hazard. For businesses, marketers, and anyone running outreach across multiple inboxes, they're an operational one. One hijacked sending account can poison an entire campaign, incinerate your sender reputation, and expose your contact list.
Look at how the damage snowballs when an AiTM compromise strikes a business inbox:
- Outbound spam from a trusted address — Attackers use the hijacked account to blast phishing at your real contacts, who trust you. Your domain reputation collapses.
- Account suspension — Google may disable an account showing compromised behavior, freezing any campaign running through it on the spot.
- Data exposure — CRM exports, client lists, and saved drafts all sit inside that inbox.
The team playbook layers a few extra defenses on top of the personal checklist: mandate passkeys or hardware keys across the organization, segment accounts so one breach can't spread, train staff to recognize calendar and ClickFix lures specifically, and monitor for unusual sign-in locations. If you're operating at volume, treat each account's security posture the way you'd treat its warm-up schedule — a deliberate, maintained process, not something you set once and forget.
It's worth remembering, too, that strong account hygiene and healthy deliverability reinforce one another. Accounts with clean security records, steady sign-ins, and no compromise events are exactly the accounts Gmail's systems trust most — and those are the trust signals that keep your legitimate mail out of the spam folder.
Account Age, Trust, and Scam Resistance
One question we hear a lot: do older, well-established Gmail accounts hold up better against the 2026 Gmail scams? The honest answer is nuanced. Age won't make you immune to phishing — an AiTM proxy will lift a 10-year-old account's session cookie exactly as easily as a brand-new one's. What stops the initial compromise is security behavior, not age.
Where account age does matter is in resilience and recovery:
- Stronger recovery options — Aged accounts typically carry well-established recovery emails, phone numbers, and a long sign-in history that Google relies on to confirm the true owner during a recovery dispute.
- Better anomaly detection — A lengthy, consistent record of normal activity makes a sudden spike of malicious behavior stand out more sharply to Google's systems, which can trigger protective challenges sooner.
- Reputation cushion — An aged account with years of clean sending is less likely to be permanently blacklisted after one incident than a fresh account with no history behind it.
This is part of why aged accounts outperform new ones for serious email work — not because they can't be phished, but because they stand on a deeper foundation of trust that's harder to wipe out. If you're sourcing established Gmail accounts for business, combine that age advantage with the security hardening above and you get the best of both: a trusted account that's also genuinely tough to hijack. The 2026 threat landscape rewards exactly that blend of structural trust and disciplined security habits.
Want help picking secure, well-aged Gmail accounts for your outreach? Browse our accounts or reach us on Telegram for guidance matched to your use case.
Frequently Asked Questions
Which three Gmail scams does Google's June 2026 advisory call out?
Google named Adversary-in-the-Middle (AiTM) phishing, calendar invite phishing, and ClickFix fake update lures. AiTM hijacks your login session and bypasses two-factor authentication; calendar phishing slips fake events onto your schedule; and ClickFix tricks you into pasting a command that installs malware. All three are designed to resemble routine, trustworthy actions rather than obvious spam.
Can these Gmail scams really get around two-factor authentication?
Yes. AiTM phishing doesn't break your 2FA — it inserts itself between you and the real login page, lets you complete the genuine two-step prompt yourself, and quietly steals the session cookie that keeps you signed in afterward. Holding that cookie, the attacker stays authenticated without ever needing your password or code again. The best defense is moving to passkeys, which are cryptographically tied to the real Google domain and won't work on a fake page.
How do I stop fake calendar invites from appearing in Gmail?
Open Google Calendar settings, go to Event settings, and set "Add invitations to my calendar" to "Only if the sender is known" or "When I respond to the invitation in email." That keeps strangers' invites from auto-adding to your schedule. You can also report a malicious invite right from the event, which helps Google block the sender for everyone.
What is a ClickFix attack and how do I avoid it?
ClickFix is a scam that dresses malware up as a routine fix — a page insists you need a browser update or CAPTCHA verification and tells you to copy and paste a command or run a download. The command installs an infostealer. One rule beats it: no legitimate site ever asks you to paste a command into your terminal or system settings to "verify" yourself. If a verification step tells you to leave your browser, close the tab immediately.
Are older Gmail accounts safer from these 2026 scams?
Account age doesn't prevent the initial phishing — an AiTM attack works identically on old and new accounts. What aged accounts do better is recover, because they come with established recovery options, a long sign-in history Google can verify against, and a reputation cushion that softens the blow of a one-off incident. Security behavior stops the attack; account age helps you survive and bounce back from one.
What should I do if I think my Gmail account was compromised?
Act quickly. Change your password from a device you trust, sign out of every session, run Google's Security Checkup to revoke unknown devices and app access, and re-enable or upgrade your 2FA to passkeys. Then check your forwarding rules and filters, since attackers frequently plant hidden ones. Our Gmail recovery guide walks through each step, and the suspended-account guide covers what to do if Google locks the account during the incident.
Will Google ever ask for my password or 2FA code by phone or email?
No. Google will never call, email, or message you to request your password, your two-factor code, or to have you paste a command anywhere. Any message that does is a scam, plain and simple. When in doubt, ignore it and go directly to your Google Account security page yourself rather than clicking any link you were sent.
The 2026 Gmail scams are sophisticated, but they all rest on the same hinge: catching you mid-routine, in a moment of trusting action. Slow down at login pages, lock down your calendar, never run pasted commands, and upgrade to passkeys — do that and you close off all three. For more on keeping your accounts secure and trusted at scale, message us on Telegram @oldgmb or explore our aged Gmail accounts built for reliable, long-term use.
