Attackers Exploit Multi-Hop Google Redirects for Sophisticated Phishing Campaigns
Cybercriminals are chaining Google services to bypass security filters in phishing campaigns that deliver credential harvesting or remote access trojans.
A novel phishing campaign is leveraging a complex chain of redirects across legitimate Google services to evade detection and deliver malicious payloads. Cybersecurity vendor KnowBe4 detailed the ongoing operation, which begins with a seemingly innocuous email containing a link designed to pass through security gateways.
The core of the evasion technique lies in the multi-hop redirect chain, which deliberately utilizes multiple Google domains. This strategy aims to trick security tools into perceiving the traffic as legitimate by presenting a series of trusted Google services, such as Google Meet, DoubleClick, Google Custom Search, and Google Tag Manager, as intermediate steps. By the time the link is inspected, all visible hops appear clean, allowing the malicious payload to proceed.
"By the time a defender inspects the sending domain, the embedded link, or the intermediate hops, everything still looks clean. The harvester at the end of the chain is built to wait for that inspection to pass," KnowBe4 threat analysts Prabhakaran Ravichandhiran and Jeewan Singh Jalal explained in their research. This contrasts with typical phishing campaigns that rely on the gateway simply missing the malicious link; this method ensures the gateway sees only trusted infrastructure.
At the conclusion of the redirect chain, victims are directed to a phishing landing page. KnowBe4 observed two primary outcomes: credential harvesting from fake corporate login pages, and the installation of ScreenConnect as a remote access tool via a deceptive identity verification prompt. The landing pages are dynamically generated, often incorporating the victim's corporate website screenshot and localizing the interface based on the user's location.
The campaign employs a variety of lures, including themes like document review, credential expiry, package delivery, payment notifications, and voicemail alerts, making it adaptable to different business contexts. Once credentials are submitted, they are rapidly sent to the attacker's Telegram channel, along with the victim's IP address, geolocation, browser string, and organizational MX records.
Researchers noted that the campaign appears targeted rather than indiscriminate. Victim email addresses are encoded in base64 and hidden within the URL's hash fragment, which browsers typically strip before sending requests. This technique effectively masks the pre-targeted nature of the campaign from server-side logs and most URL scanners.
KnowBe4 has provided indicators of compromise (IOCs) and recommended actions, including blocking IOCs at the DNS filter and proxy levels, hunting for Telegram bot API traffic, forcing credential resets for potentially affected users, and searching for unauthorized ScreenConnect installations. The presence of an email address in the URL's hash fragment is highlighted as a key indicator of a pre-targeted link.
This sophisticated use of legitimate, high-reputation infrastructure like Google services underscores the evolving tactics of threat actors seeking to bypass increasingly robust security measures. The campaign's ability to mask its true intent through a series of trusted hops presents a significant challenge for defenders relying on traditional URL inspection and filtering techniques.