Stop before entering anything if a Google Workspace sign-in page came from an unexpected message, uses an unfamiliar domain, or redirects through a look-alike site. An adversary-in-the-middle (AiTM) attack relays a fake login flow to Google in real time, so the attacker can capture credentials, one-time codes or approvals and sometimes the authenticated browser session that follows.
The most effective defense is to use passkeys or FIDO2 security keys for sensitive accounts, protect active sessions, and have an incident procedure that revokes sessions and unauthorized factors quickly. Password-plus-code or push MFA still helps, but an AiTM site can relay those steps.
As an Amazon Associate I earn from qualifying purchases.
What an adversary-in-the-middle attack does
AiTM phishing is more than a conventional fake login form. The attacker operates a relay between you and the real Google identity service. A message sends you to the relay, which displays a convincing Google-style page. When you type your details, the relay forwards them to Google, displays Google’s next prompt, and passes your responses back and forth while you sign in.
Free tools Windows power users keep installed
One-click scans. No signup required.
That live connection lets the attacker target two assets:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Authentication data: your password and, where applicable, a one-time code or approval.
- The authenticated session: after Google accepts the sign-in, the relay may try to obtain the browser session token or cookie that represents your logged-in state.
A stolen cookie can let an attacker act as the signed-in user without asking for the password again. Google Workspace security guidance describes stolen authentication cookies as an account-takeover threat and recommends phishing-resistant authentication together with session protections.
Google’s Workspace Blog reported in 2025 that phishing and credential theft drove 37% of successful intrusions. The same post reported an 84% increase in email-delivered infostealers during 2024. Those figures cover broad phishing and credential-theft activity, not AiTM attacks alone, so they should not be read as an AiTM prevalence rate.
How to tell whether a Google sign-in page is fake
Check the address before you type
Use a known Workspace bookmark or enter a trusted Google address yourself. Examine the complete address bar, not just the logo and page design. An unfamiliar domain, a look-alike spelling, a URL shortener or an unexpected redirect is a stop signal. A page can copy Google’s colors, fonts and prompts while remaining an attacker-controlled relay.
Recommended Free Tools
Do not assume that a page is genuine because it eventually shows Google’s real sign-in screen. In an AiTM flow, the attacker can forward the real screen and capture what you enter around it.
Treat urgency as a verification problem
Messages about shared files, expiring passwords, invoices, HR documents or security alerts are common lures. Do not use the message’s link to verify the claim. Open the relevant Workspace application through your normal bookmark, or confirm the request with the supposed sender through a separate channel.
Stop when the requested action is unusual
Never provide a password, one-time code or approval to a page reached from an unexpected message. Stop if the flow suddenly asks for an unfamiliar consent screen, recovery-factor change or passkey action. Contact your administrator rather than trying to satisfy a prompt that does not match your normal sign-in.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check the account after anything suspicious
From a trusted device, review recent devices and security activity on the account. Look for a new device, unfamiliar location, changed recovery information, a newly enrolled passkey or other factor, unexpected OAuth access, or activity that does not match your work. Report the message and preserve its headers and the complete URL so an administrator can investigate.
Why passkeys resist AiTM credential capture
Passkeys use an origin-bound public-key credential. The credential is created for the legitimate website or app identity, and the device will not use it for an unrelated look-alike domain. Google Developers documentation states: “Because passkeys are bound to a website or app’s identity, they’re resistant to phishing attacks.”
Google Account Help also explains: “Unlike passwords, passkeys can’t be shared, copied, written down, or accidentally given to someone else.” That makes a passkey materially different from a secret that a user can type into an attacker’s relay.
Passkeys are not a promise that every part of a device is safe. A compromised computer, malicious browser extension or already-stolen active session can still threaten an account. Keep device security, browser updates, session controls and recovery procedures in place.
Authentication options compared
| Method | Resistance to AiTM credential capture | Protection after sign-in | Requirements and compatibility | Rollout considerations |
|---|---|---|---|---|
| Passkeys | Strong: origin binding prevents the credential from being used by a look-alike site. | Does not by itself protect a session cookie stolen after login. | Requires a supported device and browser, plus a recovery plan. | Admins must decide how passkeys interact with password requirements and communicate the policy. |
| FIDO2 hardware security keys | Strong phishing resistance through a physical security key. | Does not by itself bind an already-issued browser session. | Users need the key and a compatible sign-in environment; Google lists Titan Security Key as an example of this class. | Particularly useful for super administrators and other high-value users; plan spare keys and recovery. |
| Password plus one-time code or push MFA | Better than a password alone, but an AiTM relay can forward codes or socially engineer approvals. | Does not by itself protect a stolen authenticated session. | Works with a wider range of devices and users. | Retain where phishing-resistant methods are not yet practical, while treating it as a transition control. |
| Device Bound Session Credentials (DBSC) | Not an initial sign-in method. | Strengthens protection of the post-login session by binding a session cookie to the authenticating device. | Google documented general availability in Chrome on Windows on May 28, 2026; availability and supported environments can change. | Deploy as a complement to phishing-resistant sign-in, not as a replacement for it or for incident response. |
Configure stronger Workspace protection
1. Prioritize phishing-resistant sign-in
Start with passkeys or FIDO2 security keys for super administrators, help-desk staff, finance teams, executives and any account whose compromise could expose many users or sensitive data. Then expand to the rest of the organization according to device support and recovery readiness.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsGoogle reported that passkey support was generally available to more than 11 million Workspace customers in its 2025 Workspace Blog coverage. An earlier Google announcement, based on March–April 2023 data, reported that passkeys were twice as fast and four times less error-prone than passwords. Those are Google’s published early results, not a guarantee for every organization or device.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Set the passkey and password policy deliberately
Enrolling a passkey does not automatically enable 2-Step Verification. In the Admin console’s authentication and 2-Step Verification controls, decide whether users may skip passwords with passkeys and state the intended rule in your sign-in guidance. A passkey rollout fails operationally when users do not know whether a password is still expected or how to recover if a device is lost.
- Define which groups must use a passkey or security key.
- State whether a password remains required as an additional step.
- Provide at least one approved recovery route before enrollment.
- Document how a lost, replaced or wiped device is handled.
3. Use Advanced Protection for the highest-risk users
Google’s Advanced Protection guidance supports security keys and passkeys as 2-Step Verification methods. It also enables enhanced pre-delivery scanning of incoming email, adding another layer against malicious messages reaching protected users. Apply it where the consequences of account takeover justify the additional enrollment and recovery requirements.
4. Add session protection with DBSC
Google describes DBSC as a way to bind a session cookie—the small file a website uses to remember a user’s authenticated state—to the device that authenticated. Google announced general availability in Chrome on Windows on May 28, 2026, enabled by default for Google Workspace users in that environment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →DBSC reduces the usefulness of a stolen cookie, but it does not make a compromised device harmless and does not eliminate the need to revoke sessions after a suspected compromise. Confirm current browser and Workspace availability before relying on the control for a particular user population.
How the controls work together
No single setting addresses every stage of an AiTM attack. Passkeys and FIDO2 keys protect the initial authentication exchange by making the credential unusable on the attacker’s origin. DBSC addresses a different point in the chain: it makes a stolen post-login cookie less useful by tying the session to the device that authenticated. Administrative investigation and revocation remain necessary because an attacker may have acted during the interval before detection.
For a high-value account, a practical sequence is to require a passkey or security key, keep browsers and operating systems maintained, enable available session protections, and monitor enrollment and recovery changes. If a user must temporarily use password-plus-code or push MFA, make that exception explicit, limit its duration where policy permits, and give the user a clear path to a phishing-resistant method.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Cost, compatibility and recovery trade-offs
Passkeys can use an approved device that a user already carries, but the organization still has to verify supported browsers, platform settings and recovery options. Hardware keys add a physical-device procurement and replacement consideration; they can be attractive for administrators who want a separate factor and for environments where shared or unmanaged devices are a concern. Spare keys and a documented replacement process prevent a lost key from becoming an emergency access problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Password-plus-OTP or push MFA generally reaches more existing devices, which is why it often remains during transition. Its broader compatibility does not make it phishing-resistant. DBSC may require no separate user-held factor, but its protection depends on supported browser and operating-system combinations, currently documented by Google for Chrome on Windows. Compare each option on phishing resistance, post-login protection, device and browser coverage, enforcement controls, support workload, recovery procedures and direct procurement costs before setting a standard.
What to do when a user encounters a suspicious sign-in
If no information was entered
- Close the tab and do not return through the message link.
- Report the message using your organization’s reporting process.
- Preserve the message headers, sender details and complete URL.
- Open Google Workspace from a known bookmark and check recent devices and security activity.
- Tell the administrator if the page requested an unusual consent, recovery or passkey action.
If a password, code or approval was entered
- Stop using the suspicious page and contact the administrator immediately through a trusted channel.
- From a trusted device, review recent account activity and look for new devices, factors, recovery changes or OAuth grants.
- Give the administrator the original message, headers and URL; do not delete evidence before it is collected.
- Follow the administrator’s containment instructions rather than assuming a password change alone removed every active session.
Administrator incident-response sequence
Speed matters because AiTM can leave an attacker with an active session even after the user realizes the page was fake. Use Workspace security investigation and audit data to establish what happened and contain access.
1. Contain active access first
- Revoke the affected user’s sessions and tokens.
- Remove unauthorized passkeys, security keys or other newly added factors.
- Disable or suspend the account temporarily when the risk warrants it.
2. Reset the authentication path
- Reset credentials after sessions and unauthorized factors are dealt with.
- Verify recovery addresses, phone numbers and other recovery settings.
- Require a phishing-resistant method for re-enrollment where policy permits.
3. Investigate persistence and data access
Review sign-in events, new passkey enrollment, recovery changes, OAuth grants, forwarding rules and anomalous sessions. Check whether mail was forwarded, files were accessed or shared, or additional accounts were targeted. Preserve relevant audit records and message evidence for your organization’s incident process.
4. Correct the entry point
Search for the same lure or URL across mailboxes, remove or quarantine matching messages, and warn users about the exact indicators. If a trusted sender or document was impersonated, verify the real sender through a separate channel before restoring normal workflows.
Rollout plan for organizations
- Identify high-impact accounts. Rank super administrators, help desk, finance, executives and accounts with broad data access.
- Check device and browser readiness. Confirm that users can use an approved passkey or FIDO2 key and that supported browsers are maintained.
- Establish recovery before enforcement. Issue spare hardware keys where appropriate and document lost-device handling.
- Publish a short sign-in rule. Tell users to use a known bookmark, inspect the domain, reject unexpected prompts and report suspicious pages.
- Pilot with administrators and a small group. Test enrollment, account recovery, help-desk procedures and session revocation.
- Expand by risk tier. Enforce phishing-resistant methods for the highest-risk groups first, then broaden coverage.
- Monitor and adjust. Review sign-in and audit data, failed enrollments, recovery events and reports of unexpected prompts.
Common mistakes that leave a gap
- Trusting page appearance: branding is easy to copy; the address and sign-in context matter more.
- Assuming MFA always stops phishing: OTP and push prompts can be relayed or socially engineered.
- Stopping after a password reset: an attacker may still have an active session or unauthorized factor; revoke sessions and inspect account changes.
- Enrolling passkeys without recovery planning: a lost or replaced device can become an avoidable lockout.
- Treating DBSC as a complete solution: session binding complements, but does not replace, phishing-resistant sign-in and response procedures.
- Deleting the lure: headers and the complete URL can be essential for finding other targets and removing related messages.
The practical decision rule
For users, the rule is simple: do not sign in through an unexpected link, and stop whenever the domain or requested action is unfamiliar. For administrators, use passkeys or FIDO2 keys for the accounts that matter most, define the passkey policy explicitly, add session protection where supported, and rehearse revocation and investigation. Password-plus-code or push MFA remains useful during transition, but it should not be treated as resistant to a live relay.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Frequently Asked Questions
Can AiTM phishing bypass 2-Step Verification?
It can relay a one-time code or push approval in real time, so password-plus-code and push MFA are not inherently resistant to this attack. Passkeys and FIDO2 security keys provide stronger protection because they are bound to the legitimate site or app identity.
How can I tell if a Google Workspace login page is fake?
Check the complete address before typing, and prefer a known Workspace bookmark or a trusted address entered manually. An unfamiliar domain, look-alike spelling, URL shortener or unexpected redirect is a warning. Do not rely on Google’s logo or on a page that eventually displays a genuine-looking Google prompt.
Are passkeys and security keys safe from phishing?
They are designed to resist phishing credential capture. Passkeys are origin-bound, and FIDO2 security keys perform a similar phishing-resistant role. They do not make a compromised device, malicious browser extension or already-stolen active session harmless, so device and session security still matter.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDoes enrolling a passkey automatically turn on 2-Step Verification?
No. Google states that enrolling a passkey does not automatically enable 2-Step Verification. Administrators must decide whether users may skip passwords with passkeys, which groups must use them and what recovery route applies.
What should an administrator do after a suspicious Google sign-in?
Contain first: revoke the user’s sessions and tokens, remove unauthorized passkeys or other factors, and suspend the account if warranted. Then reset credentials, verify recovery settings, review sign-ins, OAuth grants, forwarding rules and data access, and preserve the original message, headers and URL.
What does DBSC protect, and what does it not protect?
Device Bound Session Credentials bind a session cookie to the device that authenticated. Google announced general availability in Chrome on Windows on May 28, 2026, enabled by default for Google Workspace users in that environment. DBSC helps reduce the value of a stolen cookie, but it is not an initial sign-in method and does not replace phishing-resistant authentication or incident response.
Should an organization buy security keys or use passkeys?
Compare the options by phishing resistance, session protection, supported devices and browsers, enforcement, recovery, support effort and cost. Passkeys may use an approved device already in the user’s possession; hardware keys require procurement and replacement planning but provide a separate physical factor. Many organizations use both, prioritizing high-impact accounts.
The Bottom Line
Use a known sign-in path, stop at unfamiliar domains or prompts, and report suspected AiTM immediately. Protect high-impact Google Workspace accounts with passkeys or FIDO2 keys, define recovery and password policy clearly, add DBSC where supported, and revoke sessions and unauthorized factors before assuming a password reset solved the incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
