Gmail Phishing Detection with VirusTotal
Scan incoming Gmail messages for malicious links and attachments, delete threats, and alert security.
Overview
The Gmail equivalent of the Outlook phishing playbook. Monitors a Gmail abuse mailbox (or any inbox you point it at), scans every URL and attachment with VirusTotal, and takes action on confirmed malicious content by deleting the email, preserving the IOCs, and posting a Slack alert to your security channel.
Who this is for: Security teams running Google Workspace as their primary email platform
Why automate this
Google Workspace-native SOCs need the same automated triage that Microsoft 365 shops get. This playbook gives Gmail-first organizations instant coverage of their phishing reporting pipeline with the same VirusTotal-powered verdict logic.
How it works
- 01
Poll the Gmail inbox via the Gmail API for new messages
- 02
Parse the email body to extract all URLs
- 03
Submit each URL to VirusTotal for a reputation check
- 04
Extract all attachments and hash them
- 05
Look up each hash in VirusTotal and sandbox unknown files
- 06
Compare VirusTotal verdicts against your policy threshold
- 07
On malicious verdict, delete the email and log the IOCs
- 08
Post a detailed Slack alert with the verdict and sender context
Impact
Native Gmail API integration, no MX redirects or gateway changes
Automated quarantine of known-bad messages
Reduces mean-time-to-quarantine from hours to seconds
Single Slack thread per incident for analyst handoff
Related playbooks
Keep automating
Outlook Phishing Detection with VirusTotal
Scan every inbound Outlook email for malicious URLs and attachments, delete threats, and notify Slack.
Multi-Source Phishing Email Analysis
Analyze phishing emails with EmailRep, URLScan, and VirusTotal to produce a comprehensive threat report.
Suspicious Email Triage with EDR Correlation
Multi-tool email triage that cross-references threat intel with CrowdStrike endpoint detections.
Bring this playbook into your SOC
See Deployer Workflows in action with a live walkthrough of this playbook. We'll show you how to connect your SIEM, EDR, and ticketing tools in under 15 minutes.