Loading story…
A widespread phishing campaign is abusing trusted Google services—including Google Meet, Search, DoubleClick, Custom Search, Image Search, Tag Manager, and Analytics—as redirect intermediaries that bypass email gateways, firewalls, URL scanners, and sandboxing tools. Workplace-themed lures such as document-review requests, delivery notices, payment demands, voicemails, and mailbox-expiration alerts target manufacturing, government, finance, and non-profit employees before sending them to attacker-controlled Microsoft- or OneDrive-branded credential-harvesting pages.
The phishing kit extracts a victim email address from a URL fragment, validates the organization through Google Public DNS MX-record lookups, and dynamically retrieves company logos and website screenshots to tailor the lure. It screens visitors to impede analysis, sends stolen credentials and technical details to a Telegram bot, and may request passwords twice to improve capture reliability. A parallel identity-verification flow installs ScreenConnect for persistent remote access; organizations should reset potentially exposed credentials, investigate unauthorized ScreenConnect deployments, monitor for Telegram Bot API traffic, block malicious infrastructure, and report redirect chains to Google Safe Browsing.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
KnowBe4 Threat Lab published technical details on the phishing campaign, including dynamically tailored credential-harvesting pages, Microsoft device-authorization-flow interception, fake ScreenConnect installation prompts, and real-time Telegram bot exfiltration. The analysis also identified campaign-associated domains and URLs used in the redirect and phishing infrastructure.
KnowBe4 Threat Lab identified an active phishing campaign abusing Google Meet, Search, DoubleClick, Custom Search, Image Search, Tag Manager, and Analytics as trusted redirect infrastructure leading to credential-harvesting sites or fake ScreenConnect identity-verification workflows. The campaign targets personnel in manufacturing, government, finance, and non-profit organizations with workplace-themed lures.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourceblog.knowbe4.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals have launched a sophisticated phishing campaign that exploits Google Cloud's Application Integration service to send emails that closely mimic legitimate Google notifications. By leveraging the service's "Send Email" task, attackers are able to distribute messages from the trusted `noreply-application-integration@google.com` address, effectively bypassing traditional email security measures such as DMARC and SPF. The phishing emails are crafted to resemble routine enterprise communications, including voicemail alerts and file access requests, increasing the likelihood that recipients will trust and interact with them. Over a two-week period, nearly 9,400 phishing emails targeted approximately 3,200 organizations across the U.S., Asia-Pacific, Europe, Canada, and Latin America. The attack chain employs a multi-stage redirection process to evade detection and maximize credential theft. Initial links in the emails direct users to legitimate Google Cloud URLs (`storage.cloud.google.com`), followed by a redirection to `googleusercontent.com` where a fake CAPTCHA is presented to bypass automated scanners. The final stage leads victims to a counterfeit Microsoft login page hosted on a non-Microsoft domain, designed to harvest user credentials. This campaign demonstrates the increasing abuse of trusted cloud infrastructure for phishing, highlighting the need for organizations to scrutinize even seemingly authentic emails originating from reputable domains.
Jun 29, 2026
A credential phishing campaign used fake **"New Audio MSG"** emails to lure recipients to a **Play Audio** link that passed through multiple tracking and redirect stages before landing on a Google-themed sign-in page. Researchers said the operation carried a Base64-encoded copy of the target’s email address through the chain to personalize the final page, which impersonated **Google Accounts**, **Google Workspace**, or **Google Voice**. The phishing flow abused trusted-looking infrastructure and cloud services, including Framer-hosted pages and Cloudflare Workers, to make the delivery path appear legitimate and harder to block. The final phishing stages used **HTML smuggling** techniques aligned with MITRE ATT&CK `T1027.006`, including JavaScript **Blob** objects and inline content reconstruction, to hide or dynamically generate malicious content in the victim’s browser. LevelBlue also observed related multi-stage campaigns using custom CAPTCHA, anti-debugging logic, Web Crypto API decryption, and newly registered domains, with one chain ending in **OneDrive** device-code phishing. Researchers warned that layered redirects and inline browser-side payload generation can evade static blocklists and recommended preserving full redirect chains, correlating email clicks with login attempts, and blocking malicious destinations across email, web, and DNS controls.
Aug 12, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026