Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy

This sophisticated phishing operation chains together six Google properties—Meet, Search, DoubleClick, Custom Search, Tag Manager, and Analytics—to proxy malicious traffic through trusted domains, effectively bypassing email security gateways and enterprise firewalls. Victim email addresses are encoded in URL fragments, preventing server-side logging. Landing pages dynamically impersonate targeted organizations by retrieving live logos from Clearbit, capturing real-time website screenshots, and validating domains through Google's DNS API. The campaign supports 16 languages and uses dual execution tracks: one for credential harvesting with immediate exfiltration to Telegram, and another for silent deployment of the ScreenConnect remote access tool. Lures include document reviews, credential expiry notices, package delivery, payment notifications, government benefits, and voicemail themes, targeting sectors such as manufacturing, government, and finance.

The campaign enables attackers to bypass traditional email and network security controls by leveraging trusted Google infrastructure, increasing the likelihood of successful phishing attacks. Credential harvesting can lead to unauthorized access to victim accounts, while the silent installation of remote access tools like ScreenConnect facilitates persistent unauthorized access and potential further compromise of victim systems. The use of multilingual support and dynamic impersonation increases the campaign's reach and effectiveness across multiple sectors.

No official patch or fix applies as this is a phishing campaign abusing legitimate third-party infrastructure. Organizations should educate users about phishing risks, especially those involving trusted domains and dynamic content. Email security solutions should be tuned to detect unusual URL patterns and behaviors associated with this campaign. Monitoring for signs of ScreenConnect installation and immediate response to credential compromise are recommended. Since the campaign abuses Google services, users and administrators should remain vigilant and report suspicious activity to Google and relevant security teams.