Phishing Syndicate Hijacks Google Services to Slip Past Defenses and Harvest Logins

A sophisticated phishing operation is exploiting Google’s trusted infrastructure to disguise malicious links, allowing attackers to sidestep corporate email filters and lure victims into surrendering credentials. By chaining a series of redirects through legitimate Google domains, the campaign creates a veneer of authenticity that makes security tools struggle to flag the traffic as suspicious.

The scheme begins with a seemingly innocuous email that contains a shortened URL. When clicked, the link routes through multiple Google services—such as Docs, Drive, or URL shorteners—before landing on a custom-built page that mirrors the look of a target’s internal login portal. Because each hop is hosted on a Google server, many anti‑phishing solutions treat the request as safe, granting the malicious page a free pass.

Once the victim arrives at the counterfeit login screen, the site captures entered usernames and passwords in real time. In certain variants, the page also prompts the user to download a small executable, which installs the ScreenConnect remote‑access tool. This additional payload grants the threat actors persistent control over the compromised machine, enabling data exfiltration or lateral movement within the victim’s network.

Security researchers who first uncovered the operation, identified by the moniker GBHackers, note that the attackers tailor the phishing content to specific organizations, increasing the likelihood of success. By harvesting publicly available information—such as employee names, titles, and internal terminology—the malicious pages achieve a high degree of personalization, making them harder for users to doubt.

The abuse of Google’s platform raises broader concerns about the reliance on large cloud providers for email and document workflows. While Google continuously updates its abuse‑prevention mechanisms, the sheer volume of legitimate traffic makes it difficult to differentiate malicious redirects without generating false positives that could disrupt business operations.

Experts recommend a layered defense strategy: enforce multi‑factor authentication, deploy advanced URL‑reputation services, and educate staff to verify unexpected login requests through out‑of‑band channels. As the phishing group refines its techniques, organizations that combine technical controls with vigilant user behavior will be better positioned to thwart future attempts that piggyback on trusted internet services.