Attackers Use Multi-Hop Google Redirects for Phishing Campaign

Threat actors chain multiple legitimate Google service redirects to evade detection and deliver credential harvesting or ScreenConnect remote access tooling.

Threat actors are abusing multiple legitimate Google services to build multi-hop redirect chains that obscure the final destination and bypass reputation-based filtering. The campaign culminates in credential harvesting pages or silent installation of the ScreenConnect remote access tool. Defenders should watch for links that traverse trusted Google domains before landing on malicious endpoints.

• Multi-hop redirects through legitimate Google services hide the final phishing destination.
• Payloads include credential harvesting or ScreenConnect remote access installation.
• Trusted Google domains help malicious links evade reputation-based email and web filtering.