Cybercriminals are chaining multiple trusted Google services to bypass security gateways, leading to credential theft and unauthorized remote access installations.

  • Attackers use a chain of redirects across Google Meet, Analytics, and Tag Manager to evade email filters.
  • The campaign harvests credentials and deploys ScreenConnect for remote system access.
  • Victim-specific data is hidden in URL hash fragments to remain invisible to server logs.

In a sophisticated evolution of social engineering, threat actors are now utilizing a "multi-hop" redirection strategy involving various Google services to slip malicious links past high-end security gateways. According to research published by KnowBe4, this method allows attackers to weaponize the inherent trust that security tools place in Google domains.

The mechanics of the attack are deceptive. Instead of a direct link to a malicious site, the phishing email contains a URL that bounces through a sequence of legitimate Google domains, including Google Meet, DoubleClick ad infrastructure, Google Custom Search, Google Image Search, Google Tag Manager, and Google Analytics. Because each "hop" is a trusted domain, most automated link inspectors mark the URL as safe.

Read Also:Adobe Unveils AI-Driven Transformation for Photoshop with New Interface

Why This Matters

BozokMedia analysis shows that this campaign represents a shift from "spraying and praying" to highly targeted, surgical strikes. By exploiting the trusted infrastructure of a global giant like Google, attackers are effectively neutralizing the first line of defense for thousands of enterprises globally.

Once the victim reaches the final destination, the landing page employs dynamic JavaScript. It constructs a fake login portal tailored to the victim's specific corporate identity by pulling a live screenshot of the victim's actual company website. This level of personalization significantly increases the success rate of the credential harvest.

"By the time a defender inspects the sending domain or the intermediate hops, everything still looks clean; the harvester simply waits for the inspection to pass."

The lures used in this campaign are varied, ranging from urgent document reviews and payment notifications to government benefit alerts. Once credentials are stolen, they are instantly routed to a Telegram bot, providing the attacker with the victim's IP address, geolocation, and organizational MX records.

To counter this, KnowBe4 recommends that security teams hunt for unauthorized ScreenConnect installations and monitor for Telegram bot API traffic within their networks. They specifically warn that any email address appearing after a '#' in a URL is a strong indicator of a pre-targeted attack.

Did You Know?: The use of a URL hash fragment (#) is a clever trick because browsers strip this information before sending the request to the server, making the targeted email address invisible to most server-side security logs.

Frequently Asked Questions

1. Are Google's services compromised in this attack?
No, Google's services are not breached. The attackers are simply using the existing redirection capabilities of these services to mask their final malicious destination.

2. How can organizations protect themselves?
Implement strict Multi-Factor Authentication (MFA) and train employees to recognize that even links appearing to come from trusted domains can be redirects to phishing sites.