Reported by 3 outlets

Timeline

1. original reporting

   Global Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal Credentials

   gbhackers.com · 36d ago · September 7th, 2026

   A large-scale phishing operation is abusing trusted Google services as a multi-stage redirect network to bypass email security controls, deliver highly personalized credential-harvesting pages, and, in some cases, install ScreenConnect remote-access software. The campaign’s central advantage is that it presents trusted Google-owned domains at nearly every point a gateway, proxy, or analyst is likely to […] The post Global Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Hackers Abuse Google Services as Trust Proxy to Steal Credentials and Deploy ScreenConnect

   cyberpress.org · 36d ago · September 7th, 2026

   Threat actors are abusing trusted Google services to route phishing victims through legitimate-looking links before sending them to credential-harvesting pages or installing ScreenConnect remote-access software. According to a KnowBe4 Threat Lab analysis, the active campaign uses Google infrastructure as a trust proxy. Instead of placing an obvious malicious link in an email, attackers direct recipients through Google Meet, Google Search, DoubleClick, Custom Search, Image Search, Tag Manager, and Analytics services. Security gateways, firewalls, and URL scanners often trust these Google domains, allowing the phishing chain to pass initial inspection. The campaign targets organizations in manufacturing, government, finance, and non-profit sectors. Attackers use document-review, Microsoft 365 expiry , FedEx delivery, OneDrive payment, government-benefit, and voicemail-themed lures. Some emails impersonate DocuSign, QuickBooks, Microsoft, FedEx, and Social Security services. Google Services Power ScreenConnect The phishing URLs often use multiple redirects before reaching attacker-controlled infrastructure. One observed chain starts with a Google Meet link redirect, moves through Google Search, and then passes through a DoubleClick click-tracking endpoint. Other variants abuse redirect parameters in Google Custom Search, regional Google Image Search domains, Google Tag Manager, or Google Analytics. An example document review lure (Source: knowbe4) The attackers hide a target’s e

3. update from www.hissenit.com

   Phishers Turn Google's Own Infrastructure Into a Trust Proxy → Researchers uncovered an active, targeted phishing campaign → Deliberate chai

   www.hissenit.com · 27d ago · September 16th, 2026

   Phishers Turn Google's Own Infrastructure Into a Trust Proxy → Researchers uncovered an active, targeted phishing campaign → Deliberate chai

   via Mastodon https://www.hissenit.com/en/blog/it-security-awareness-news-roundup-09-2026.html