Fake Google Meet pages aim to steal Google credentials and 2FA codes
Original title: Hackers Using Fake Google Meet Pages to Steal Google Credentials
Reported domains meet-google.cyou and qooglo.com also expose an /install page showing database configuration and a prefilled password.
Threat intelligence posted on October 19, 2026, and reported October 20, describes two lookalike domains hosting fake Google Meet pages meant to collect Google credentials and support two-factor phishing. Anurag (@Malwarehunterr) also reported an exposed /install path that reveals database configuration and a prefilled database password; the password value is not published. The report does not confirm stolen accounts or say whether the exposed secret was used.
Unconfirmed: The report does not confirm any accounts were stolen or that the exposed database password was used.
- Domains are meet-google.cyou and qooglo.com, not meet.google.com.
- Listed paths include /meet, /install, /assets/js/demo.js, and /api/demo/sessions.
- No sample file, malware name, IP address, or hash is provided.
- Google guidance cited favors security keys, prompts, or passkeys over phishable codes.
Impact: Stolen Google passwords and two-factor codes
- 1.Avoid entering passwords or codes on meet-google.cyou or qooglo.com.
- 2.If credentials were entered, change the Google password and review account activity.
- 3.Search logs for /meet, /install, and /api/demo/sessions paths.
- ATT&CK
- T1566 Phishing
- Vendors
- Products
- Google Meet
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | meet-google.cyou | mmediate concern. The two domains reported in this case are meet-google[.]cyou and qooglo[.]com . Their names resemble Google-related te |
| domain | qooglo.com | wo domains reported in this case are meet-google[.]cyou and qooglo[.]com . Their names resemble Google-related terms, but neither |
From the original article
4 min read at cybersecuritynews.com
Two websites are hosting fake Google Meet pages designed to steal Google account credentials and carry out phishing involving two-factor authentication (2FA), according to threat intelligence shared on October 20, 2026. The pages imitate a familiar meeting service to make a request for account details look more believable. The researcher also reported a serious security […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.