A real phishing campaign is tricking employees with a “missed voicemail” message that claims they have a new audio message. Clicking “Play Audio” sends victims through multiple trusted-looking redirects and ends on a fake Google sign-in page that captures Google Workspace credentials, potentially enabling access to email, Drive, calendars, and SSO-connected apps.
This campaign impersonates a missed voicemail notification, using the lure text "New Audio MSG" alongside a "Play Audio" button. Employees who click the button are not taken to an audio file. Instead, the link routes them through a series of redirects designed to obscure the final destination. These redirects pass through trusted infrastructure, including SendGrid and AWS click-tracking services, before landing on a fake Google Workspace or Google Voice page hosted at coderkubes[.]com. From there, a Blob URL is used to render a convincing Google login page directly in the browser, and phishing scripts fetched from attacker-controlled infrastructure capture the entered credentials.
A notable detail is that a Base64-encoded version of the victim's email address is carried in the URL fragment, which pre-fills the phishing page and makes it look more legitimate and personalized.
The campaign avoids common email security triggers by skipping suspicious attachments entirely and instead relying on a simple text-based notification. It also exploits misplaced domain trust: because the redirect chain starts on well-known, reputable cloud services like AWS and SendGrid, many legacy security tools and reputation-based filters do not flag the early stages of the chain as malicious. By the time the victim reaches the fake login page, they have already passed through several layers that appeared safe.
Employees should treat unexpected voicemail or audio alerts with suspicion, especially when they require signing in before playback. Voicemail notifications should play audio, not demand an account password. Before entering any credentials, employees should check the browser address bar and treat a Blob URL or an unfamiliar domain as an immediate red flag, regardless of how official the page branding looks. Rather than clicking links in unexpected alerts, employees should open the relevant service directly in a new browser tab to check for real messages.
Security teams can reduce risk by monitoring email telemetry for unusual redirect patterns that move from trusted cloud services to unknown domains, and by blocking identified malicious domains at the DNS and web proxy layers. Since stolen Google Workspace credentials can expose email, Drive, calendars, contacts, and SSO-connected apps, this type of credential theft carries broad downstream risk across an organization.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The attack begins with an email claiming a new voicemail is waiting, labeled with the lure text New Audio MSG and a Play Audio button. Clicking it routes victims through redirects on trusted infrastructure before landing on a fake Google sign-in page that captures credentials.
It avoids suspicious attachments and instead uses redirects through SendGrid and AWS click-tracking, which are trusted domains that legacy security tools often do not flag as malicious.
Treat any notification that asks for a login before playback as suspicious, check the browser address bar for Blob URLs or unfamiliar domains, and open the service directly in a new tab instead of clicking the link.
Stolen credentials can enable access to email, Drive, calendars, contacts, and SSO reset options for connected enterprise apps.
You get an email: subject line says “New Audio MSG,” big blue button that says “Play Audio.” Looks like a missed Google Voice voicemail, right? But when you click, the link quietly bounces through SendGrid and AWS tracking, then lands on coderkubes dot com and finally a Blob URL showing a perfect-looking Google sign-in page with your email already filled in. That’s the trap: it’s not Google at all. Scripts pulled from spy.mwork801 dot com capture your Google Workspace password, which can unlock your email, Drive, calendar, and even SSO-connected apps. If a “New Audio MSG” makes you sign in, stop. Close it, then open Google Voice or Gmail in a new tab yourself and check there for any real voicemail.
Researchers reported a phishing setup that clones WhatsApp and Instagram login pages and uses valid HTTPS (TLS) certificates to look legitimate. Victims are lured via WhatsApp messages about “verification,” “pending payments,” or “customer support,” then sent to typosquatted lookalike domains to…
Criminal groups are stealing Meta Business Manager and Google Ads accounts using phishing that arrives through trusted platforms like Salesforce, Google Workspace mail-merge, and SharePoint links. The stolen accounts are valuable not just for the budget inside them, but because older accounts with…
Researchers described a now-patched flaw ("AgentForger") where a single benign-looking ChatGPT link could silently create and publish an attacker-controlled Workspace Agent inside a company. If an employee was already logged in and had connected apps (like email, Drive, Slack, or Teams), the agent…
Cofense observed a real phishing campaign impersonating Google Ads Sync Accounts (MMC) with a fake “maintenance/system upgrade” notice. The email pressures recipients to click “Complete Sync Account,” sending them through lookalike sites and a fake Google sign-in pop-up that captures credentials.…
Cofense reports a sustained rise in real phishing campaigns disguised as party/event invitations that trick people into clicking links. The same invitation lure is being used both to steal usernames/passwords via fake login pages and to install legitimate-but-abused remote access tools that give…
Levi Strauss reported that an unauthorized party used social-engineering to compromise three employees’ company-issued computers and steal corporate data. Reporting tied the incident to a wider campaign where attackers impersonated IT help desks using spoofed phone numbers and fraudulent websites…
