Are ‘App Passwords’ the Hidden Weakness in Your SMB’s Email Security?

Imagine your company invests in two-factor authentication (2FA) for Gmail to keep hackers out—only to find out that a loophole could let sophisticated attackers sidestep 2FA protection entirely. That’s exactly what happened in a newly uncovered campaign, where a Russian-linked hacking group (known as APT29) exploited Google’s application-specific passwords (“app passwords”) to sneak into business email accounts, even when 2FA was enabled. The attack, confirmed by Google Threat Intelligence and Citizen Lab, is a wake-up call for small and mid-sized businesses (SMBs): the tactics of sophisticated cybercriminals are now being aimed at companies just like yours.

What Are App Passwords, and Why Do They Matter?

App passwords are special, one-time codes that let users connect certain apps (like mail clients) to Google accounts without entering their main password each time. Convenient—yes, but they were originally designed for older devices and apps that don’t support 2FA. If a hacker tricks someone into generating an app password, they can bypass 2FA completely and get access to email, files, and more.

How the Attack Works—In Simple Terms

• Spear Phishing: Attackers impersonate trusted contacts or IT providers and trick users into sharing credentials or generating a new Google app password.
• Bypass 2FA: The hacker uses this app password to sign in via email apps, avoiding any 2FA pop-ups or warnings.
• Compromise: Once inside, attackers have access to sensitive company data, client communications, and may attempt further scams or wire fraud.

Note: According to IBM’s Cost of a Data Breach Report 2023, stolen or compromised credentials are the most common initial attack vector, accounting for 19% of breaches (IBM, 2023).

Why SMBs Are Prime Targets

These attacks aren’t just a big-business problem. SMBs, often with less IT oversight and more “bring your own device” flexibility, are frequently targeted by APTs (advanced persistent threats). Attackers know that one breached email account can open the door to valuable financial information, client data, and even your digital brand reputation.

Key Takeaways—What Your Business Can Do in the Next 30 Days

1. Audit App Password Usage: Immediately check with users and IT staff for any active app passwords on your Google accounts—remove those that aren’t absolutely needed.
2. Disable App Passwords Where Possible: Google Workspace admins can prevent employees from creating new app passwords. Review the security settings on your admin console.
3. Train Employees on Spear Phishing: Educate your team about targeted phishing scams and simulate attacks so they know what to look for (look-alike emails, urgent credential requests, etc.).
4. Enhance Identity Security: Implement Identity Threat Detection & Response (ITDR) to monitor unusual login patterns and flag suspicious activities—BoltWork.ai offers specialized ITDR services for SMBs (learn more).
5. Enable Alerts: Make sure your Google accounts send alerts for new logins and changes in security settings. Rapid notification = faster response.

If you’re unsure how your current Google Workspace settings stack up or want an expert opinion, book a free 30-minute assessment with BoltWork.ai. Let’s secure your workspace and reduce risk—confidentially and cost-effectively.

From Complexity to Confidence: Secure, Simplify, Reduce Costs

Bolting on extra tech or requiring endless user vigilance isn’t the answer. At BoltWork.ai, we help SMBs design practical security controls that work in the real world—enabling your people to work while keeping attackers out. Here’s how we align with your business goals:

• Secure: Closing loopholes like app passwords, layered with identity and device threat protection (see all security services).
• Simplify: Consolidated dashboards and proactive alerts, so you see risks before they become breaches.
• Reduce Costs: Predictable managed services for IT and cybersecurity—so you avoid the high costs of breaches or legal troubles down the road.

Don’t wait for a headline to include your company. Testing and tightening your email and identity security is actionable today. Book a 15-minute security consult with BoltWork.ai and discover practical, affordable steps to keep your business safe from sophisticated threats like APT29.

References

• IBM. (2023). Cost of a Data Breach Report.
• The Hacker News. (2025). Russian APT29 exploits Gmail app passwords to bypass 2FA in targeted phishing campaign.
• Google Threat Intelligence Group & Citizen Lab. (2025). Campaign disclosures.