Threat actors have refined a phishing technique that leverages legitimate Google services as intermediaries to bypass email security controls and credential harvest operations.
The attack chain exploits multiple Google properties, including Google Forms, Google Sites, and Google Sheets, creating a series of redirects that obscure the attacker's true infrastructure. Phishing emails direct victims to what appears to be a legitimate Google service. Upon clicking, victims encounter a second redirect through another Google property before landing on a credential harvesting page or ScreenConnect installation.
This multi-hop approach exploits a fundamental trust relationship. Organizations whitelist Google's vast IP space and domains to maintain business functionality. Email gateways, URL filters, and sandboxing systems treat Google's infrastructure as low-risk. By routing malicious payloads through these trusted services, attackers achieve a dual benefit: obfuscation of their command-and-control infrastructure and bypass of perimeter defenses.
The ScreenConnect payload represents the endgame. ScreenConnect, now owned by ConnectWise, functions as remote access software. Once installed, attackers gain persistent remote access to compromised endpoints. From that foothold, adversaries can move laterally across network segments, extract sensitive data, deploy ransomware, or establish long-term persistence.
The credential harvesting phase serves an immediate purpose. Stolen credentials provide attackers with valid authentication tokens for accounts ranging from email to cloud applications. Harvested credentials from user accounts accelerate post-compromise movement. Attackers bypass multi-factor authentication challenges that would halt lateral movement attempts using stolen passwords alone. Harvested credentials also enable account takeover for lateral movement into related systems.
This attack pattern aligns with tactics employed by financially motivated threat groups. The combination of initial access through phishing, credential harvesting, and remote access tool deployment follows the playbook of groups focused on ransomware deployment or data theft operations.
Detection requires layered defenses that move beyond simple URL filtering. Email security must employ advanced sandboxing that detonates attachments and follows redirect chains to identify malicious endpoints. URL rewriting and click-time protection analyze destination pages after user interaction. Network monitoring tools must establish baselines for ScreenConnect traffic, which typically operates over specific ports and protocols.
Organizations should enforce conditional access policies that trigger additional authentication when logins occur from unfamiliar IP addresses or geographic locations. This catches compromised credentials before attackers establish remote access. Endpoint detection and response platforms must alert on ScreenConnect installation, particularly from unexpected processes or network locations.
User awareness training remains essential. Phishing emails often contain social engineering cues that distinguish them from legitimate Google redirects. Suspicious requests for credentials, unexpected prompts for re-authentication, or links in unsolicited emails warrant verification before clicking.
Google has worked to restrict abuse of its services for phishing redirects, but determined attackers continuously adapt. The use of multiple hops increases complexity for detection systems and creates plausible deniability about where the attack originated. Organizations relying solely on perimeter defenses will remain vulnerable.