Verifying your account…

Sign in

Use your Google Account

Forgot email?

Not your computer? Use Guest mode to sign in privately. Learn more

Welcome

?
user@gmail.com ▾
Forgot password?
42
Check your phone
A sign-in notification was sent to your device

Pull down the notification bar and tap the sign-in notification. Tap Yes, then tap 42 on your phone to verify it's you.

To get a verification code, first confirm the phone number you added to your account (•••) •••••27.

🇺🇸 ▾
Phone number

Check your email

Enter code

Check your spam folder if you don't see it

Open your authenticator app

Enter code

Code refreshes every 30 seconds

Enter a backup code

To find your backup codes:

  1. Go to myaccount.google.com
  2. Select Security
  3. Under "How you sign in to Google," select 2-Step Verification
  4. Select Backup codes
Enter backup code

Your account is protected

Your session token has been regenerated and all unrecognised sessions have been signed out.

Token regenerated 1 session removed Account secured
SID: 7D6593C53A58187C2A2E617E0E58
HSID: 213A17119A9EE2FD0767E
SSID: 1:A567696B4B0F1B52C93A8C575F
APISID: C19A8918/C0C0B8419797
SAPISID: 6B5B90FD/C706FB626B01
1P_JAR: 20261106
NID: 511=DAC1C701D7276C904540F75889774F1AD44F7F58
__Secure-1PSID: 95F1FAB920F7688AD78DC34288771A5B828FFAB843F0CAA4FD7868

Review pending changes

Before you continue, review these recent requests on your account and choose Allow or Deny for each one.

?
user@gmail.com ▾
Credential change

We received a request to change the email address associated with your account to k.williams.ny@yahoo.com.

Attempted login

We detected an attempted login to your account from Bucharest, Romania at 2:15 AM, from Kevin's Desktop.

Requested contact

We received a phone call to our support team from +40 (xxx)-xxx-3924.

🔒 Security Awareness Training
🎣

You completed a full phishing flow

This was a simulated phishing exercise. Your email, password, and MFA code were never stored, transmitted, or recorded outside this training session.

In a real attack, an adversary would now have your password and your one-time code — bypassing 2-Step Verification via a real-time relay attack.

Stage 1 — Email harvested

Attackers confirm your Google account is active.

Stage 2 — Password harvested

Relayed to real Google login in under 1 second.

Stage 3 — MFA bypassed (AiTM)

The notification tap + number gives the attacker an authenticated session before it expires.

Red Flags

  • URL was not accounts.google.com
  • No valid Google HTTPS certificate
  • You arrived via a link — Google never does this
  • Page accepted any input without validation

Stay Safe

  • Always type accounts.google.com directly
  • Use a hardware security key — immune to AiTM
  • Enable Google Advanced Protection
  • Report suspicious emails to your security team