[lokar]

I remember at some point Google disallowed more phishing attacks from red teams. Nothing new was being learned. They always work.

[lima]

Google solved credential phishing a long time ago using hardware tokens (gnubby - the predecessor to FIDO/U2F/Passkeys...).

There's other types of social engineering, but phishing is mostly an engineering issue.