Phishing campaigns abuse trusted platforms and authentication flows to evade detection and steal credentials

Multiple active phishing operations are leveraging trusted services and by-design web/authentication features to bypass security controls and harvest credentials and MFA data. GTFire is a large-scale credential-harvesting campaign that hides behind legitimate Google-owned domains by abusing Firebase and Google Translate to make phishing links appear trustworthy to email filters and web gateways; victims are sent to brand-impersonation login pages and then redirected to the real site after submitting credentials. Separately, Microsoft reported phishing that abuses OAuth redirection behavior in identity providers (including Microsoft Entra ID and Google Workspace) by registering malicious OAuth apps with attacker-controlled redirect URIs and using silent auth flows/invalid scopes to bounce users to attacker infrastructure; Microsoft disabled the identified malicious Entra OAuth applications but noted related activity continues and requires monitoring.

A distinct but thematically similar campaign uses a fake Google Account security site to trick users into installing a malicious Progressive Web App (PWA) that can steal one-time passcodes (via WebOTP where supported), harvest data (e.g., clipboard contents), and even turn the victim’s browser into an attacker-controlled proxy with internal port-scanning capability; Malwarebytes-linked reporting highlighted the lure domain google-prism[.]com and the use of permission prompts (notifications/clipboard) to enable ongoing abuse. Other items in the set cover unrelated threats (Android malware using generative AI for persistence, an Iraq-focused APT toolchain, a separate AiTM phishing-kit attribution case study, and research on a cybercrime infrastructure provider), and do not describe the same specific phishing operations described above.