GTFire Phishing Scheme Uses Google Services to Evade Detection

Group-IB reported on a phishing operation tracked as GTFire that abuses trusted Google services to reduce suspicion and bypass security controls. The campaign uses legitimate Google infrastructure as part of its delivery or redirection chain, allowing phishing content and lures to blend in with normal enterprise traffic and making detection more difficult for defenders.

The activity highlights a broader attacker tactic of hiding malicious workflows behind reputable cloud platforms that users and security tools often implicitly trust. For CISOs and security teams, the incident underscores the need to inspect links and redirects involving trusted SaaS domains, strengthen phishing-resistant authentication, and tune email and web defenses to detect abuse of legitimate services rather than relying solely on domain reputation.