Attackers Use Multi-Hop Google Redirects for Phishing Campaign

According to a report from Dark Reading, threat actors are conducting a phishing campaign that abuses multiple Google services in a multi-hop redirect chain. The attackers route victims through a series of Google-owned or Google-trusted domains to evade detection by security filters and email gateways. The ultimate goal of the campaign is twofold: harvesting login credentials from victims and installing ScreenConnect, a legitimate remote access tool, on compromised systems. The multi-hop technique involves chaining several redirect steps, each passing through Google services, which helps obfuscate the final malicious URL and bypass security controls that rely on reputation scoring of known malicious domains. The campaign has been observed globally, though the specific threat actor group behind the operation has not been named in the report. Victims who interact with the phishing lure are directed to credential-harvesting pages or prompted to execute actions that result in ScreenConnect installation, granting attackers remote access to the affected system. Security experts recommend that organizations implement additional email security controls to inspect redirect chains, educate users to verify URLs even when they appear to originate from trusted domains, and monitor for unusual API usage within Google Workspace environments.