Threat actors are abusing trusted Google services to route phishing victims through legitimate-looking links before sending them to credential-harvesting pages or installing ScreenConnect remote-access software.
According to a KnowBe4 Threat Lab analysis, the active campaign uses Google infrastructure as a trust proxy.
Instead of placing an obvious malicious link in an email, attackers direct recipients through Google Meet, Google Search, DoubleClick, Custom Search, Image Search, Tag Manager, and Analytics services.
Security gateways, firewalls, and URL scanners often trust these Google domains, allowing the phishing chain to pass initial inspection.
The campaign targets organizations in manufacturing, government, finance, and non-profit sectors.
Attackers use document-review, Microsoft 365 expiry, FedEx delivery, OneDrive payment, government-benefit, and voicemail-themed lures. Some emails impersonate DocuSign, QuickBooks, Microsoft, FedEx, and Social Security services.
Google Services Power ScreenConnect
The phishing URLs often use multiple redirects before reaching attacker-controlled infrastructure. One observed chain starts with a Google Meet link redirect, moves through Google Search, and then passes through a DoubleClick click-tracking endpoint.
Other variants abuse redirect parameters in Google Custom Search, regional Google Image Search domains, Google Tag Manager, or Google Analytics.
The attackers hide a target’s email address in the URL hash fragment. Browsers do not send URL fragments to web servers, helping the attackers conceal the pre-targeted email address from server logs and many security tools.
The email address may be Base64-encoded and is decoded only when the victim reaches the final page.
After the redirect chain ends, victims land on phishing infrastructure hosted on attacker-controlled domains, compromised websites, Cloudflare Workers endpoints, and .vu domains.
Some pages display a “Hold on briefly” screen or a fake CAPTCHA challenge to delay analysis and filter automated scanners. The phishing kit also profiles visitors. It can collect IP address, city, country, browser details, and browser language.
It checks the victim organization’s MX records using Google Public DNS, likely to avoid wasting effort on fake, research, or sandbox email domains.
The final credential page is designed to look like a real company login portal. The phishing kit extracts the victim’s domain from their email address and retrieves the organization’s logo from Clearbit.
If that fails, it can use Google’s favicon service. It may also request a live screenshot of the organization’s public website and use it as the phishing page background.
The victim’s email address is already filled into the sign-in form, while the browser tab title and page text are customized with the company name.
The kit supports 16 languages, including English, Chinese, Japanese, Korean, Spanish, German, French, Arabic, Russian, and Vietnamese, KnowBe4 said.
Indicators of Compromise
| IOC Type | Indicator | Category | Notes |
|---|---|---|---|
| Domain | vazquezfleytas[.]com | Credential harvester | Terminal destination used in redirect chain |
| Domain | zh-l-haixing[.]com | Credential harveste |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
