THREAT actors have been abusing a chain of Google services to bypass security gateways and harvest credentials or deploy remote access tools. In a KnowBe4 report published on 4 September, researchers describe a three-hop redirect sequence that moves from an initial phishing email to a malicious landing page.
The chain traverses services including Google Meet, DoubleClick ad infrastructure, Google Custom Search, Google Image Search, Google Tag Manager, and Google Analytics, with the aim of making the link appear legitimate at every hop.
At the end of the redirects, victims reach a credential harvesting page or a page that installs ScreenConnect as a remote access tool via a fake identity verification prompt. The landing page dynamically builds a credential page using the victim’s email address, displaying a live screenshot of the company site behind the login. The campaign is targeted rather than mass‑market; victim addresses are Base64‑encoded in the URL hash fragment, rendering it invisible to server logs and many URL scanners.
IOCs include Telegram exfiltration of stolen data, and the threat actors claim to collect IP address, geolocation, browser string and MX records. In response, KnowBe4 recommends blocking IOCs at DNS filter, proxy and SIEM levels; hunting for Telegram bot API traffic; forcing credential resets for users seen in lures; and checking for unauthorized ScreenConnect installations. Google did not comment when contacted.