Loading story…
Google has launched a new security feature for Gmail and Google accounts that allows users to designate trusted friends or family members as recovery contacts. This feature is designed to help users regain access to their accounts if they are locked out, for example, due to forgotten passwords, lost passkey devices, or account compromise. Users can select up to 10 trusted contacts, who must accept the request to serve in this role. When a user is locked out, they can initiate the recovery process, which involves sharing a code with their chosen contact. The contact receives a notification and must verify the request by selecting the correct code from a set of options, ensuring that only genuine requests are honored. This process uses number-matching authentication to reduce the risk of social engineering attacks. Google recommends that users choose contacts who are likely to respond quickly, as the recovery request expires after 15 minutes. The company also advises selecting individuals with strong cybersecurity awareness to minimize the risk of exploitation by attackers. The trusted contacts feature is part of Google’s broader push towards passkeys as the future of account authentication, addressing the challenge of device loss that can leave users unable to access their accounts. The recovery process is designed to be secure, with the contact unable to access the user’s account directly, but able to verify the user’s identity. Google Messages will also alert users to spam and help keep texts private, further enhancing account security. The setup process for recovery contacts is straightforward and can be completed on both desktop and mobile devices via the Google account security settings. This new method provides an additional layer of resilience for account recovery, supplementing existing options like email and SMS. The feature aims to reduce the frustration and risk associated with being locked out of critical accounts, especially as more users transition to passwordless authentication. Google’s approach balances convenience with security, leveraging personal trust relationships while maintaining technical safeguards. The company acknowledges that, while unlikely, sophisticated attackers could attempt to exploit the process, so user vigilance remains important. Overall, the trusted contacts feature represents a significant enhancement to Google’s account recovery options, providing users with more reliable and secure ways to regain access to their accounts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Google launched a new account recovery feature that lets users designate a trusted contact who can help them regain access if they are locked out of their Google or Gmail account. Multiple reports on October 16, 2025 describe the feature as newly available and intended to reduce permanent account lockouts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcego.theregister.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has introduced a **selfie-video** option for Google Account sign-in recovery, giving locked-out users a new way to verify their identity when they cannot access their usual phone or computer. The process requires users to enroll by recording a guided video with head movements, then later submit a new live video that Google compares against the original to confirm the account owner’s identity. The rollout adds a biometric recovery path but has also raised privacy and security questions about storing facial video and defending against deepfakes or synthetic-video injection. Google said the uploaded videos are encrypted at rest, stored securely, can be deleted by users, and are not shared; users can also opt out of allowing the data to be used for additional purposes such as improving verification methods. Security experts cited in coverage said live video is generally stronger than a still image for identity checks, but should be paired with signals such as device integrity, location, behavioral analytics, browser settings, and IP address, making the feature better suited as a fallback recovery mechanism than a routine authentication method.
Jul 24, 2026
Google announced updated **Android Theft Protection** capabilities aimed at reducing account takeover and financial fraud risks following device theft, with availability starting on devices running **Android 16+**. The updates strengthen authentication safeguards by making **screen lock guessing** harder (longer lockout periods after repeated failed PIN/pattern/password attempts) and by improving controls around lock behavior after excessive failed authentications, including a dedicated settings toggle for *Failed Authentication Lock*. Google also expanded **Identity Check**—which requires biometric authentication for sensitive actions when the device is outside trusted places—to cover a broader set of actions and apps that use the **Android Biometric Prompt**, including third-party banking apps and **Google Password Manager**. In parallel, Android’s *Remote Lock* capabilities were highlighted as part of the theft-response toolset, giving users more control to lock a lost or stolen device and limit further misuse.
Jun 29, 2026
Google has made **Device Bound Session Credentials (DBSC)** generally available in Chrome, rolling it out for Google Workspace customers, Workspace Individual subscribers, and personal Google accounts to blunt account takeovers driven by stolen session cookies. The feature cryptographically binds a session cookie to the device where authentication occurred, using hardware-backed protections such as the **Trusted Platform Module** on Windows and **Secure Enclave** support on macOS, so exfiltrated cookies cannot be replayed on another machine to bypass MFA. Google said DBSC is enabled by default for Workspace customers, integrates with **Context-Aware Access** for device-aware policy decisions, and exposes binding events in audit logs to help administrators monitor session integrity. The move follows sustained abuse of stolen Google authentication artifacts by infostealers and adversaries leveraging mechanisms such as the undocumented OAuth **MultiLogin** API, with operators tied to **Lumma** and **Rhadamanthys** claiming they could restore expired cookies. At the same time, researchers at Phishu disclosed **VaultJacking**, a phishing technique that can steal an entire Google Password Manager vault after capturing a victim’s 6-digit PIN, then registering an attacker-controlled device to sync passwords and passkeys without malware or prior device compromise. Phishu said the attack sidesteps DBSC because it does not rely on replaying stolen cookies, underscoring that Google’s new protection sharply reduces pass-the-cookie risk but does not stop credential- and PIN-based phishing against synced account data.
Jun 29, 2026