Attackers are chaining together multiple Google services in order to get phishing links past security gateways.
Cybersecurity vendor KnowBe4 published research on Sept. 4 concerning an ongoing phishing campaign observed in the wild. To some extent, the mechanics of the campaign are typical: The threat actor sends a malicious email under false pretenses, the victim clicks the link, and the link leads to a malicious landing page where the victim is compromised.
What sets this campaign apart is the link in the initial phishing email. In order to bypass gateways, email filters, and other security tools, the link relies on a chain of redirects across Google domains, intending for link inspectors to see multiple Google domains and let the URL through.
Attackers regularly lean on redirects through legitimate infrastructure and have for years, but this method stands out because the threat campaign deliberately uses multiple Google services within the redirection chain. KnowBe4 threat analysts Prabhakaran Ravichandhiran and Jeewan Singh Jalal described a three-hop redirect chain that uses services including Google Meet, DoubleClick ad infrastructure, Google Custom Search, Google Image Search, Google Tag Manager, and Google Analytics.
"By the time a defender inspects the sending domain, the embedded link, or the intermediate hops, everything still looks clean. The harvester at the end of the chain is built to wait for that inspection to pass," the blog post read. "Most phishing campaigns embed a malicious link and bet on the gateway missing it. This one does not need the gateway to miss anything. It feeds the gateway exactly what it expects: trusted Google domains at every hop."
Using Google Infrastructure in Targeted Attacks
At the end of the chain, the URL redirects to a phishing landing page. In some instances, KnowBe4 observed credential harvesting from a fake corporate login page. In others, a script installs ScreenConnect as a remote access tool via a fake identity verification prompt.