Google Workspace bulk export/Takeout activity following OAuth or app-password grant

Duo Tech@duotech

•updated Aug 8, 2026•1•0•35

Detects Google Workspace bulk export/Takeout activity occurring shortly after an OAuth grant or app-password creation, or an unusual volume of export/download events, consistent with automated Gmail/Docs/Keep data exfiltration.