This sophisticated phishing campaign chains together six Google properties—Meet, Search, DoubleClick, Custom Search, Tag Manager, and Analytics—to proxy malicious traffic through trusted Google domains, effectively bypassing common email and network defenses. Victims' email addresses are encoded in URL fragments to avoid server-side logging. Landing pages dynamically impersonate targeted organizations by fetching live logos from Clearbit, capturing real-time screenshots, and validating domains through Google's DNS API. The campaign supports 16 languages and employs two main attack tracks: credential harvesting with immediate exfiltration to Telegram, and silent installation of the ScreenConnect remote access tool. Lures include document reviews, credential expiry notices, package delivery, payment notifications, government benefits, and voicemail themes, targeting sectors such as manufacturing, government, and finance.

The campaign enables attackers to bypass email security gateways and enterprise firewalls by leveraging trusted Google infrastructure, increasing the likelihood of successful phishing attacks. Victims risk credential compromise and unauthorized remote access through ScreenConnect installation. The use of legitimate Google domains for proxying malicious content complicates detection and blocking efforts, potentially leading to data breaches and unauthorized system access in targeted organizations.

No official patch or fix applies as this is an abuse of legitimate cloud infrastructure rather than a software vulnerability. Organizations should increase user awareness about phishing tactics that leverage trusted domains and monitor for suspicious activity related to credential use and remote access tools. Email security solutions should be tuned to detect unusual URL patterns and behaviors despite the use of trusted domains. Vendors managing Google services handle infrastructure security; users must rely on layered defenses and user training.