Attackers Use Multi-Hop Google Redirects for Phishing Campaign
BLUF
Threat actors are abusing trusted Google domains to evade email security and deliver credential stealers or remote access malware.
NEWS
A new phishing campaign chains multiple Google redirects to mask the final malicious destination from security scanners. The goal is either harvesting user credentials or installing ScreenConnect for unauthorized remote control. This method exploits the inherent trust placed in Google's infrastructure by email filtering systems.
Why I Care
This undermines reputation-based email security, increasing the likelihood of successful data breaches and ransomware infections across all sectors. Any organization using standard email gateways is vulnerable to these evasive tactics without additional inspection layers.
Next Steps
Security teams must configure email gateways to analyze redirect chains rather than relying solely on final domain reputation by next Friday. Administrators should enforce multi-factor authentication immediately to mitigate credential theft risks. End users need updated training on recognizing suspicious redirects within trusted domains this week.
Source: Dark Reading ·