Kiran 
A newly uncovered global phishing operation has managed to get Google to vouch for it. Instead of hiding malicious links and hoping email filters miss them, the campaign routes victims through six legitimate Google services before ever touching attacker infrastructure, turning the very trust signals defenders rely on into camouflage.
Researchers at KnowBe4 Threat Lab, led by analysts Prabhakaran Ravichandhiran and Jeewan Singh Jalal, documented a multi-hop redirect architecture spanning Google Meet, Google Search, DoubleClick ad infrastructure, Custom Search, Image Search, Tag Manager, and Analytics.
Each hop exploits an open redirect or debug parameter that these services expose for legitimate purposes, such as meeting links, ad-click tracking, or analytics logging, and repurposes it to shuttle victims toward attacker-controlled domains on .vu, .de, and workers.dev infrastructure.
Phishing Campaign Hijacks Google Meet, Search & Analytics
Crucially, the victim’s email address is included in the URL’s hash fragment, often base64-encoded. Browsers strip fragments before sending requests to servers, so the address never appears in logs on any hop, including Google’s, making the campaign’s pre-targeting nearly invisible to scanners and researchers alike.
Once a victim clears an interstitial “verification” screen and a fake CAPTCHA challenge, the harvester builds itself dynamically from the decoded email address.
It pulls the victim’s actual company logo from Clearbit, grabs a live screenshot of the company’s website as the background image, and pre-fills the email field, leaving only the password to enter.
A Google Public DNS lookup even verifies the domain has valid MX records first, quietly filtering out sandbox and researcher traffic. The interface localizes into 16 languages based on browser locale, from Arabic to Vietnamese, underscoring the campaign’s global reach.
The campaign doesn’t stop at stealing passwords. Lures span document-review notices, fake Microsoft 365 expiry warnings, FedEx delivery scams, OneDrive/QuickBooks payment alerts, Social Security benefit notices, and bogus voicemail alerts, each tailored to a different victim class across manufacturing, government, finance, and nonprofit sectors.
Depending on the lure, victims land on one of two tracks. Track A presents a convincing Microsoft sign-in page or a device-code phishing flow that directly intercepts authentication tokens, bypassing MFA.
Track B, tied to identity-verification lures, silently installs ScreenConnect, a legitimate remote-monitoring tool, granting attackers persistent, interactive access to the victim’s machine that survives password resets.
Submitted credentials are exfiltrated instantly to a Telegram bot, complete with IP address, geolocation, browser fingerprint, and verified MX data.
A rigged “invalid password” prompt forces a second submission, giving operators two confirmed credential pairs before quietly redirecting the victim to their real company site as if nothing happened.
This operation succeeds not by evading inspection but by satisfying it, presenting trusted Google domains at every checkpoint a security gateway is built to trust.
That reframes the defensive problem: organizations can no longer treat “Google-hosted link” as a proxy for safety, and must instead scrutinize destination behavior, fragment-encoded parameters, and post-redirect page conduct rather than domain reputation alone.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
