Attackers Use Multi-Hop Google Redirects for Phishing Campaign
Threat actors chain multiple legitimate Google service redirects to evade detection and deliver credential harvesting or ScreenConnect remote access tooling.
Threat actors are abusing multiple legitimate Google services to build multi-hop redirect chains that obscure the final destination and bypass reputation-based filtering. The campaign culminates in credential harvesting pages or silent installation of the ScreenConnect remote access tool. Defenders should watch for links that traverse trusted Google domains before landing on malicious endpoints.
- Multi-hop redirects through legitimate Google services hide the final phishing destination.
- Payloads include credential harvesting or ScreenConnect remote access installation.
- Trusted Google domains help malicious links evade reputation-based email and web filtering.
- Vendors
- GoogleScreenConnect
- Products
- ScreenConnect
- Organizations
From the original article
Threat actors are abusing multiple Google services to evade detection, ultimately harvesting credentials or installing ScreenConnect remote access.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.