Google Workspace

OpenCode Console, a hosted service for managing AI provider API keys, was breached on October 16, 2026, potentially exposing API keys for Google, OpenAI, and Anthropic stored by approximately 1.4% of users. The breach has been linked to a large-scale distillation attack. Affected users have been notified to revoke compromised keys immediately and replace them. Some users report unauthorized billing charges totaling hundreds of dollars. Attackers may continue attempting to access OpenCode systems.

• OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and (opens in a new tab)

Nikkei Inc. disclosed a breach of a Google Workspace employee account beginning in late July 2026, potentially exposing names and email addresses of 1,646 employees and business partners. The unauthorized access was discovered in early August after a security alert from Google and remediated through password reset. A related Microsoft 365 breach from the same incident led to approximately 9,000 phishing emails sent to internal and external contacts.

• Nikkei Inc. Discloses Microsoft 365 and Google Workspace Email A(opens in a new tab)

Security researchers from PortSwigger disclosed CSS bomb attacks that exploit CSS styling code in email to hijack webmail interfaces and steal credentials. The technique affects Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail. Attackers use CSS quirks and pseudo-elements to turn emails into invisible keyloggers that capture passwords in real-time. Some flaws have been patched after bug bounty disclosure, but others remain unresolved.

• CSS Bomb Attacks Turn Malicious Emails Into Password-Stealing Ke(opens in a new tab)
• New CSS Bomb Attacks Let Hackers Steal Passwords and Tokens From(opens in a new tab)

Security researchers disclosed techniques called Pass-ta-key that can bypass biometrics protections in Google Password Manager, potentially allowing attackers to hijack the password manager and steal passkeys and stored credentials. The research was published on August 4, 2026.

• Experts reveal Google Password Manager can be hijacked to let ha(opens in a new tab)
• Malware Can Steal Google’s Synced Passkeys Without Password or F(opens in a new tab)

Google revealed an ongoing data theft campaign attributed to Chinese nation-state actors (UNC6508/INFINITERED) exploiting Google Workspace security to target a diverse set of national, state, and private medical entities, including research and defense organizations. The campaign represents active exploitation affecting high-value targets across critical sectors.

• Google says Chinese hackers cracked Workspace security to hit 'a(opens in a new tab)