Researchers have published a report detailing the exploitation of a now-patched critical Google Cloud Platform (GCP) zero-day vulnerability, which if exploited, could allow threat actors to install maliciously crafted hidden applications within victims’ Google and/or Workspace accounts. The flaw has been coined GhostToken, and stems from an attacker’s ability to convert the already authorized OAuth application into a malicious trojan that cannot be seen or removed from a victim’s Google account application management page. This is achieved by deleting the GCP project for Oauth, putting it in a hidden “pending deletion” state, while the threat actor modifies and then unhides the application, granting them access to the victim’s Google Account by use of the authorized “ghost” Oauth access token. This poses a major threat to companies implementing Google Workspace, as exploitation could allow threat actors to conduct a wide range of malicious activity like viewing and exfiltrating or deleting sensitive company information, as well as sending phishing emails from the victims’ compromised accounts. This vulnerability also poses a risk to Google Accounts users in general, as exploitation also allows threat actors to track victim location data, as well as delete data from their Google Calendars, Photos, and Drive. The update to GCP will now show all applications pending deletion in the user application management page. CTIX analysts recommend that all Google Accounts and Workspace users ensure that their software is running the most recent security patch.