Researchers reported an active, large-scale phishing campaign that starts with links hosted on legitimate Google services, then redirects victims to attacker-controlled sites. The final pages mimic Microsoft sign-in or “identity verification” flows to steal credentials/MFA codes or trick targets into installing ScreenConnect remote-access software. The phishing pages can be personalized with the victim’s employer branding and pre-filled email address to look more convincing.
Researchers at KnowBe4 Threat Lab identified an active, wide-scale phishing campaign that begins with links hosted on legitimate Google services. Victims click a link inside a message such as a document review or mailbox-expiration notice, and the link starts on a trusted Google service like Meet, Search, or DoubleClick before redirecting through a chain of pages. The final destination is an attacker-controlled site that mimics a Microsoft sign-in or identity verification flow. Depending on the variant, the end goal is either stealing Microsoft credentials and device authorization codes, or convincing the victim to install ScreenConnect, a legitimate remote administration tool, giving the attacker interactive access to the endpoint.
The use of legitimate Google services as the entry point is central to why this campaign works. A familiar Google address in a message may be exactly what makes a target trust the link enough to click. From there, redirect chains vary across campaign instances, which complicates efforts to block a single fixed path and helps the links survive early security checks. The attacker site also performs target filtering, using fake human-verification prompts and company-domain checks, to reduce the chance that automated scanners or researchers ever see the actual phishing page. Personalization adds another layer of credibility: some pages are tailored with the victim's employer logo and a pre-filled email address.
Organizations across manufacturing, government, finance, and nonprofit sectors have been targeted, and the campaign supports multiple languages, indicating broad, opportunistic targeting rather than a narrow focus. Employees, IT helpdesk staff, and security teams should be trained to navigate directly to a service instead of clicking through a message, even when the initial link looks legitimate. Any request to install software during a supposed identity verification step should be treated as a serious warning sign and reported immediately. If ScreenConnect or another remote access tool may have been installed, a password or MFA reset alone is not sufficient. The device itself should be treated as potentially compromised and investigated accordingly, since this campaign extends beyond simple credential theft toward direct endpoint access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It routes targets through legitimate Google services such as Meet, Search, and DoubleClick before redirecting them to attacker-controlled pages, which helps the links survive early security checks.
The campaign either steals Microsoft credentials and device authorization codes through a fake sign-in page, or tricks victims into installing ScreenConnect, a legitimate remote administration tool, to gain interactive access to the device.
The attacker-controlled site performs target filtering using fake human-verification prompts and company-domain checks so scanners or researchers are less likely to see the malicious page.
Security teams should not stop at a password reset. If remote-access software may have been installed, the device itself should be treated as potentially compromised and investigated accordingly.
You get an email: "Action required, please review the attached document" with a legit-looking Google link. Feels safe, right? But this campaign chains through Google Meet, Search, or DoubleClick, then quietly lands you on a fake Microsoft sign-in page dressed up with your company logo and your email already filled in. That’s the trap: multiple redirects to dodge filters, then either steal your Microsoft password and MFA code, or push a fake identity check that installs ScreenConnect for full remote access. If a link starts on Google but sends you through weird redirects to a Microsoft login or identity check, stop. Close it, then go to office.com or your usual app directly and sign in from there.
Researchers found multiple espionage groups using the same Chrome+Windows exploit kit (“BlueMoon”) within days of each other. The groups sent realistic phishing emails (internship requests, conference outreach, procurement inquiries, and vaccination appointments) that pushed victims to click links…
Check Point researchers demonstrated a real proof-of-concept where a victim’s ChatGPT session could be tricked into running hidden, attacker-controlled tasks in parallel with the user’s normal request. In the demo, the attacker used a covert cross-account channel to make ChatGPT access the victim’s…
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Researchers describe a phishing workflow where an attacker logs into a victim’s Google account using stolen password + authenticator code, then quickly enrolls a new passkey to keep access even if the password is changed. The trick relies on victims choosing a weaker sign-in fallback (one-time…
