Google AppSheet Phishing Job Scams: How to Spot and Avoid Them

Cybersecurity researchers and consumer advocates are warning users about a sophisticated phishing campaign where scammers leverage AppSheet, a Google tool, to deliver fraudulent job offers directly to primary email inboxes.

AppSheet is a Google platform designed for companies to build applications and automate professional workflows without requiring traditional coding. Because the tool is a legitimate Google service, emails sent through it are appearing in the main inboxes of targets rather than being filtered into spam folders.

How the Phishing Scheme Operates

The scam utilizes the no reply at Appsheet.com address to send messages that mimic professional recruitment outreach. These emails are often highly tailored to the recipient, featuring well-written content that references specific professional experience and qualifications to bait the target into inquiring about a job for which they are actually qualified.

By exploiting a trusted Google domain, the attackers bypass standard security filters that typically flag suspicious external senders. This allows the phishing attempts to reach the user’s main inbox, increasing the likelihood that the recipient will trust the sender and engage with the content.

Google’s Response and Mitigation

Google has been notified of the exploitation of AppSheet for these phishing purposes. According to reports from April 9, 2026, the company has stated that they are aware of the problem and are currently working to stop the abuse of the platform.

The sophistication of these attacks highlights a growing trend in phishing where bad actors use legitimate cloud services and automation tools to lend credibility to their fraudulent communications.

Guidelines for Users

Security experts advise users to exercise extreme caution when receiving unsolicited job offers, even if they appear tailored to their specific skill set or arrive from a Google-affiliated domain.

The primary recommendation for those who receive these emails is to avoid engagement entirely. Because the messages are designed for phishing, interacting with the email or clicking provided links can compromise personal information.

• Do not engage with emails sent from no reply at Appsheet.com regarding job offers.
• Be skeptical of highly tailored recruitment emails that bypass spam filters.
• Avoid clicking links or providing personal data in response to unsolicited outreach from automation platforms.