Attackers Use Multi-Hop Google Redirects for Phishing Campaign
Attackers use multi-hop Google redirects for phishing, harvesting credentials or installing ScreenConnect.
Threat actors are employing a sophisticated phishing campaign that leverages multiple Google services to create a chain of redirects, making it harder for security teams to detect and block. This multi-hop approach ultimately leads victims to pages designed to steal credentials or deploy ScreenConnect for remote access.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are chaining multiple legitimate Google services (e.g., Google Docs, Google Translate, Google AMP) to create layered redirect paths that obscure the final malicious destination, making URL-based filtering and reputation checks ineffective. This technique exploits the inherent trust organizations and security tools place in Google-owned domains, allowing phishing links to pass through email gateways and proxy filters undetected. Victims are ultimately delivered credential-harvesting pages or ScreenConnect installers, enabling persistent remote access. This attack highlights the critical gap between user awareness of 'trusted' domain names and the reality that legitimate infrastructure can be weaponized as a delivery mechanism.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ScreenConnect