Direct Message Injection for Google Workspace

Direct Message Injection (DMI) places simulation messages straight into a Google Workspace mailbox through the Gmail API instead of sending them over SMTP. Because the message never travels the inbound mail path, it is not touched by spam filtering, antivirus scanning or routing rules, so a simulation reaches the inbox exactly as it was designed.

Use DMI when allow-listing the Cyberdise sending infrastructure in Google Workspace is impractical, or when message filtering keeps rewriting or quarantining simulations.

What you need

• A Google Workspace organisation holding the target mailboxes.
• A Google Cloud project in which you can create a service account.
• Super-admin access to the Google Workspace Admin console to authorise domain-wide

delegation.

1. Create a service account and key

1. In the Google Cloud console open IAM & Admin → Service Accounts → Create service account.
2. Give it a name, for example cyberdise-dmi, and create it. You do not need to grant it any project roles.
3. Open the new service account, go to Keys → Add key → Create new key → JSON, and download the key file. It contains the client_email and private_key you will need.
4. On the service account's Details page, note the Unique ID (Client ID) — a long number. You need it in the next step.

2. Enable the Gmail API

In the Google Cloud console open APIs & Services → Library, find Gmail API and enable it for the project.

3. Authorise domain-wide delegation

1. In the Google Workspace Admin console open Security → Access and data control → API controls → Domain-wide delegation → Add new.
2. Enter the service account's Client ID from step 1.
3. For OAuth scopes, enter exactly:

`` https://www.googleapis.com/auth/gmail.insert ``

1. Authorise.

Restrict the scope. gmail.insert lets the service account write into any mailbox in the organisation. Keep the authorisation limited to this single scope, and only run awareness campaigns against the users who are in scope.

4. Add the application to Cyberdise

1. Go to Advanced → Settings → Integrations → Google Workspace Apps.
2. Select Add Google Workspace App and fill in Name, Client Email and Private Key (copy both from the JSON key file — the private key is the whole -----BEGIN PRIVATE KEY----- … -----END PRIVATE KEY----- block).
3. Save. The private key is stored encrypted and is never shown again.

5. Switch a module to Direct Message Injection

DMI is chosen per module, so you can mix it with ordinary sending inside one campaign.

1. Open the campaign, go to Modules and edit the module.
2. On the Details tab set Email Delivery Method to Direct Message Injection (Google Workspace).
3. Choose the Google Workspace App you added and save.

The other delivery methods remain available on the same dropdown:

What to expect

• Messages appear in the recipient's Inbox, marked unread.
• Spam filtering, antivirus and routing rules are bypassed.
• Unlike the Microsoft 365 path, the full message (including the X-Cyberdise-* tracking

headers) is inserted as-is, so simulation correlation is reliable.

• Delivery failures are written to the message log of the campaign

Troubleshooting