Attackers Use Domain Fronting to Tunnel Malicious Traffic via Google Meet, YouTube and Chrome Update Servers

On September 24, 2025, GBHackers reported that attackers are exploiting Google's core services, including Google Meet and YouTube, using a technique called domain fronting. This method allows malicious traffic to masquerade as legitimate connections to trusted domains, enabling data tunneling through Google's infrastructure without detection.

The article explains how domain fronting works by leveraging discrepancies in the TLS handshake and HTTP Host header, making it difficult for network monitors to identify malicious activity. Despite previous blockades by major providers, researchers found a way to restore fronting capabilities through Google Cloud services. The article emphasizes the need for security teams to adapt their detection strategies to counter this emerging threat.