How to remediate Google Drive share phishing in Google Workspace

An incident-response workflow for a malicious Drive share that reached your staff: what to preserve, how to pull the notification out of inboxes on each Education edition, what can and cannot be done about the shared file itself, and how to close it out. Education Fundamentals and Standard/Plus are handled separately, and so is the ORINEX Compliance workflow.

You have confirmed it: a document shared into your domain from an outside Google account, carrying the business office's name, pointing at a credential page. Some staff opened it. You do not yet know how many, or whether any of them signed in.

This is the response, in the order that limits damage. The investigation that establishes the facts is a separate guide, how to investigate a malicious Google Drive share, and this one assumes you have at least the document title, the sharing account, and one recipient's copy of the notification. If the sharing account belongs to your own domain, you also have a compromised account, and that response runs alongside everything below.

The short answer

You are dealing with three identities, and only one of them is the attacker. The mail came from Google's notification service. The share came from a Google account the attacker controls. The name on the document belongs to a colleague who did nothing. Every step below acts on the second one, or on your own users; none of them acts on the first, and blocking it is the one mistake that makes things worse (why blocking the sender does not work).

The notification can be removed from inboxes. The share cannot be revoked by you. Google gives Education Standard and Plus administrators a console tool that finds and deletes messages domain-wide. Education Fundamentals administrators find the recipients in the console but remove the messages with other tooling. Nobody outside the file's owner can revoke the share; each recipient can report their own copy.

Treat anyone who signed in or approved anything as compromised, now, and treat the organization whose account was used as a victim who has not been told yet.

1. Preserve before you remove

Removal destroys evidence, so capture first: the recipient who reported it, the sharing account's address, the document title and file ID, the notification time, screenshots of the notification and of the document as it appears in Drive, and the destination link as text if it can be read without visiting it. One preserved copy of the notification also gives you the exact subject line and sender your searches in step 3 depend on.

2. Confirm the sharing account

The notification body and the file's details in Drive both name it. Decide internal or external before going further; the investigation guide covers how, including a read-only GAM query that lists what was shared into a user's Drive by whom. Internal means suspend that account first and start the compromised-account checklist in parallel. External means the rest of this guide.

3. Find every recipient

Your recipient list is in Gmail, not in Drive; Google logs activity on an externally owned file on the owner's side, not yours. Three routes, by edition:

  • Email Log Search, on every edition including Education Fundamentals: search on the sender address from your preserved copy, the date, and the subject. Full detail within 30 days; older than that Google requires the recipient address and message ID and shows post-delivery status only.
  • Gmail log events under Reporting, Audit and investigation, on Fundamentals, Standard and Plus.
  • The security investigation tool, on Standard and Plus, which searches the same Gmail log events and then lets you act on the results in step 4.

If you use GAM, the read-only search below lists every mailbox holding a notification with the document's title in the subject. It is the preview for the removal that follows, and it is worth running twice: once to see the list, once with a narrower query if the list contains anything you did not expect.

gam all users print messages query "from:drive-shares-dm-noreply@google.com subject:(Salary Schedule) newer_than:2d" headers "Date,Subject,To,Delivered-To"

Replace the sender address with the exact From address of your preserved copy. Google uses more than one Drive notification address (published examples include drive-shares-dm-noreply@google.com and drive-shares-noreply@google.com), and a query that names the wrong one finds nothing and looks like good news. The same substitution applies to every command below.

4. Remove the notification from inboxes

The point of removal is to take away the easy path to the document. It does not touch the document; step 5 covers that.

Education Standard and Plus

The security investigation tool is Google's answer here, and Google lists Education Standard and Plus among the editions that have it. Search Gmail log events for the notification, open a message from the results, and Google documents these actions on it: Delete message, Mark as spam, Mark as phishing, Send to inbox and Send to quarantine. Google describes the tool as letting you "find and erase malicious emails, mark emails as spam or phishing, or send emails to users' inboxes." Viewing the message content itself needs the right privileges and edition; Google's page on viewing sensitive content covers that.

Prefer Mark as phishing or Mark as spam over Delete message when you can: they move the message out of the way, they apply Google's classification, and they are reversible.

Education Fundamentals

Fundamentals has Email Log Search and Gmail log events, so you can see exactly who received the notification. What it does not have is a way to act on those messages from the console: the take-action features belong to the security investigation tool, which Fundamentals does not include. Email Log Search only ever reports; it cannot remove anything.

Removal on Fundamentals means the Gmail API, and GAM is the common way to reach it. The read-only search in step 3 is the required preview. Then, to move the notifications to each recipient's Trash, where they are recoverable and out of the inbox:

gam all users trash messages query "from:drive-shares-dm-noreply@google.com subject:(Salary Schedule) newer_than:2d" doit

GAM will not act without doit; run without it first and it reports what it would do. Trash is recoverable, which is the reason to prefer it, and also its weakness: a recipient can open Trash and click. If your policy is to remove the message entirely:

gam all users delete messages query "from:drive-shares-dm-noreply@google.com subject:(Salary Schedule) newer_than:2d" doit

Read Google's own description of the API call this makes before you run it: "Immediately and permanently deletes the specified message. This operation cannot be undone. Prefer messages.trash instead." Everything the guide said about narrowing the query applies double here. A subject: term that is too short, or a newer_than: window that is too wide, will remove legitimate share notifications along with the malicious ones, and there is no getting them back.

ORINEX Workspace Compliance

The same job in ORINEX is the Message Removal page, and it is built around the preview-then-act shape above. It requires a super administrator, it is refused during an evaluation, and it is a Compliance-tier feature.

You choose a scope (the whole domain, one organizational unit, or the members of one group), enter the Gmail query, and run a scan. A scan reads and changes nothing; it lists the matching messages with sender, subject and date, and can be run as many times as it takes to narrow the query. With the list on screen you select the messages and either Move to Spam (reversible, and the closest thing to a report that Google's API allows) or Delete, which requires typing DELETE and acts on the message IDs of the list you reviewed, not on a fresh search, so nothing that arrived after your scan can be swept up. A separate Block future mail filter can trash future matches, by sender or by a phrase in the message; for Drive-share phishing the phrase is the one to use, because the sender is Google. Every action is written to the Activity Log with the administrator, the scope and the count.

Side by side, without overstatement:

Google security investigation toolORINEX Message Removal
EditionsEducation Standard and PlusAny Google Workspace edition; ORINEX Compliance tier
Find recipientsYes, from Gmail log eventsYes, by scanning mailboxes in a scope
See message contentYes, with the required privilegesNo; sender, subject and date
Delete from inboxesYesYes, by reviewed message ID, permanent
Reversible optionMark as spam or phishing, send to quarantineMove to Spam
Mark as phishing for GoogleYesNo; Google exposes no report API
Block future copiesThrough Gmail settings, separatelyFilter by sender or content phrase
Record of the actionAdmin log eventsORINEX Activity Log

Where you have Standard or Plus, Google's tool does this job and can also mark the message as phishing, which ORINEX cannot. Where you have Fundamentals, the console cannot remove messages at all, and the choice is between GAM at the command line and a tool that wraps the same API with a review step.

5. Address the shared file

What you can do about the file itself is narrower than people expect, because your organization does not own it.

  • Each recipient can report it: right-click the file under Shared with me, Block or report, Report, choose the type, and optionally block the sharing account. Google is notified, the file moves to that user's Spam, and it is permanently removed after 30 days. This is per recipient. Google also states that "you can't report files or folders that you or members of your organization own", which is the internal-sharer case, handled through the account instead.
  • Removing it from Shared with me is housekeeping, not revocation. Remove tidies that user's own view of Drive; it does not change who has access to the file, and it is not a control an administrator can apply for anyone else. For a malicious file, report it.
  • You cannot revoke the share for everyone. Only the owner, or Google acting on reports, can do that. Removing the email in step 4 does not change who has access to the file. If Google's own evaluation later blocks the file, access is blocked for everyone; you cannot make that happen on demand.

Tell affected staff to report, and tell them why the email disappearing did not do it for them.

6. Find out who acted on it

Opening the document is invisible to you when the file is externally owned. Look for the consequences instead: sign-ins from unfamiliar places after the notification time in the user log events, suspicious-login alerts in the Alert center, OAuth grants in the OAuth log events and under each user's connected applications, and a direct, specific question to each recipient: after you opened it, did you type your password anywhere or approve anything?

7. Remediate affected accounts

Anyone who answered yes, or whose account shows a sign-in or grant you cannot explain, is compromised until proven otherwise. Suspend first, then work through what to check after a Google Workspace account is compromised: what suspension and a password change each revoke, the app passwords Google's own pages disagree about, and the filters, forwarding, delegation and recovery details that survive both. Then look at whether those accounts have already been used to share the same document onward, because a compromised internal account turns an external campaign into an internal one.

8. Tell the organization whose account was used

If the sharing account belongs to another school, a college or a business, their account is very probably compromised and they very probably do not know. Find their IT or security contact on their website, or use the conventional security@, abuse@ or postmaster@ addresses. Give them the account, the document title and file ID, the time with its time zone, and a plain description of what the document did, with a screenshot rather than the live link. Assume nothing about what they already know.

9. Put a temporary control in place if it is still running

If notifications are still arriving, two controls can be configured quickly. Neither is instant: Google notes that Gmail quarantine and blocked-sender changes "can take up to 24 hours but typically happen more quickly", and that Drive sharing changes can take up to 24 hours to apply, so keep removing and monitoring while a new rule takes effect.

  • A Gmail content compliance rule that quarantines inbound Drive notifications matching the campaign's specifics: the document title, the sharing account or its domain, the destination domain in the body. Content compliance is available on Education Fundamentals, Standard and Plus, its actions are reject, quarantine, or deliver with modifications, and quarantine is the right one while you are tuning it. The methodology, and the reasons not to match on Google's sender address, are in using Gmail content compliance to quarantine Drive phishing.
  • Tightening who can receive external shares, for the parts of the organization that do not need them, through Drive's allowlist option or, on Standard and Plus, trust rules with the Receiving files trigger. The trade-offs are real and are covered in how to reduce Google Drive share phishing.

Neither is a reason to skip the removal. Both are reasons the next wave arrives smaller.

10. Monitor for recurrence

Keep the searches from step 3 and re-run them for a few days; campaigns rotate document titles and sharing accounts, so search on the shape (Drive notifications from accounts outside your domain to many staff in a short window) as well as on the specifics. Watch the Alert center. On editions with the security investigation tool, an activity rule can alert on a log-event pattern you define; Google notes that because activity rules act after the event, they alert and remediate rather than block. Write down what you did and when, which accounts you touched and why, and what you told the other organization. If any of this ever becomes a records or data-protection matter, that record is what you will want to have.

What not to do

Do not block Google's Drive notification addresses. Every legitimate Drive share notification in the district stops, and the document is exactly as shared as it was.

Do not delete before you preserve. The subject line you need for the search is in the copy you are about to remove.

Do not run a broad query. Permanent deletion with a two-word subject match and a two-week window will remove real collaboration along with the lure, and Google's own API documentation says the operation cannot be undone.

Do not treat removed mail as revoked access. The file is still in every recipient's Shared with me.

Do not stop at the reporter. Do not assume the users who stayed quiet were unaffected; search for every recipient.

Sources

Message Removal in ORINEX Workspace Compliance is the step-4 workflow above with the review built in: scope, query, a scan that changes nothing, a list to review, and removal or Spam only for what was reviewed, recorded in the Activity Log. Where Google's own investigation tool is available it does the same job and can mark the message as phishing, which ORINEX cannot. What ORINEX Workspace does.