Multi-Hop Google Redirects Used to Bypass Phishing Defenses
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers are chaining multiple legitimate Google services (e.g., Google Docs, Google Translate, Google AMP) to create layered redirect paths that obscure the final malicious destination, making URL-based filtering and reputation checks ineffective. This technique exploits the inherent trust organizations and security tools place in Google-owned domains, allowing phishing links to pass through email gateways and proxy filters undetected. Victims are ultimately delivered credential-harvesting pages or ScreenConnect installers, enabling persistent remote access. This attack highlights the critical gap between user awareness of 'trusted' domain names and the reality that legitimate infrastructure can be weaponized as a delivery mechanism.
Tactical Insight
Immediate actions
- Train end users to scrutinize the final destination URL before entering credentials, even when intermediate links appear to belong to trusted domains like Google.
- Configure email security gateways to follow and inspect redirect chains rather than only evaluating the initial URL in a message.
- Block or alert on unsanctioned remote access tools such as ScreenConnect being downloaded or executed in your environment.
Long-term improvements
- Implement a Zero Trust browsing policy using browser isolation or secure web gateway technology that evaluates the terminal destination of all redirect chains.
- Establish an allowlist of approved remote access tools and enforce application control policies to prevent unauthorized installations.
- Conduct regular phishing simulation exercises that include multi-hop and trusted-domain redirect scenarios to build employee resilience.
Detection measures
- Enable deep-link inspection and sandboxing in your email security platform to detonate and analyze redirect chains at time of click.
- Monitor endpoint telemetry and SIEM alerts for unexpected installations or executions of remote administration tools like ScreenConnect or AnyDesk.
- Create threat-hunting queries to detect outbound connections to known Google redirect abuse patterns (e.g., unusual use of Google Translate or AMP proxy URLs in email links).