[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7sDiyxM3EU1-KeEs-N2Vh9XeuT9wnycVLG2Zm_cmGUU":3},{"article":4,"iocs":41,"watch_terms":44,"solutions":45,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"60214180-eb3c-4395-92c5-7f2fde115cfb","Attackers Use Multi-Hop Google Redirects for Phishing Campaign","attackers-use-multi-hop-google-redirects-for-phishing-campaign-dacffe","Threat actors are abusing multiple Google services to evade detection, ultimately harvesting credentials or installing ScreenConnect remote access.","Threat actors are employing a sophisticated phishing campaign that leverages multiple Google services to create a chain of redirects, making it harder for security teams to detect and block. This multi-hop approach ultimately leads victims to pages designed to steal credentials or deploy ScreenConnect for remote access.","Attackers use multi-hop Google redirects for phishing, harvesting credentials or installing ScreenConnect.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fattackers-multi-hop-google-redirects-phishing-campaign","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt03ee880bdb37bd5a\u002F6aa06071aa16bb4982ce6be0\u002Fhopscotch-LeoPatrizi-GettyImages-1303877346.jpg?width=720&quality=80&disable=upscale","2026-09-08T21:03:46+00:00","2026-09-08T22:00:08.367127+00:00",7,[17,20],{"name":18,"type":19},"Google","vendor",{"name":21,"type":22},"ScreenConnect","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[42],{"type":38,"value":21,"context":43},"Remote access tool deployed by attackers",[18,21],{"controls":46,"vendors":130},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":77,"name":78,"problem":79,"products":80},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":106,"name":107,"problem":108,"products":109},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[110,117,124],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":106,"product_name":114,"url":115,"description":116},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":121,"url":122,"description":123},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":146},"multi-hop-google-redirects-used-to-bypass-phishing-defenses","Multi-Hop Google Redirects Used to Bypass Phishing Defenses","Attackers are chaining multiple legitimate Google services (e.g., Google Docs, Google Translate, Google AMP) to create layered redirect paths that obscure the final malicious destination, making URL-based filtering and reputation checks ineffective. This technique exploits the inherent trust organizations and security tools place in Google-owned domains, allowing phishing links to pass through email gateways and proxy filters undetected. Victims are ultimately delivered credential-harvesting pages or ScreenConnect installers, enabling persistent remote access. This attack highlights the critical gap between user awareness of 'trusted' domain names and the reality that legitimate infrastructure can be weaponized as a delivery mechanism.",[136,137,138,139,140,141,142,143,144,145],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SC-7 – Boundary Protection","NIST Phish Scale (Phishing Awareness Framework)","MITRE ATT&CK T1566.002 – Phishing: Spearphishing Link","MITRE ATT&CK T1219 – Remote Access Software","GDPR Article 32 – Security of Processing (where credential theft leads to data breach exposure)",{}]