Woke up this morning to find my Google Ads account had been silently added to two manager accounts I've never seen before. No email, no popup, nothing. Checking the change history, three random email addresses I don't recognise were tweaking budgets and signing new service agreements. But here's the kicker - under Admin → Access & Security, only my team's emails show up. The intruders aren't listed there. They're ghosts operating through those manager accounts.
I'm staring at this like a retention chart that just flatlined at the 3-second mark. How is this possible without admin approval? Someone in the thread pointed out it's probably through a master manager account (MCC) that an admin authorised at some point - maybe a phishing attack, maybe a dodgy agency connection we forgot about. If you've ever used a marketing agency, that's a vulnerable entry point.
Changed every connected password immediately, removed all unnecessary admin users, and I'm waiting on Google Ads support. But the real panic is this: if I'm the account admin, why can't I edit budgets or service agreements anymore? Why can outsiders make changes without appearing in the access list?
Check your accounts right now. Look at your manager account list, your change history, your authorised users. Most damage happens because attackers sit inside longer than you'd think. Don't assume it can't happen to you - someone in the thread said 'you cannot get access without giving,' but clearly you can if you don't know who gave it. I'm still shaking over here.
