Global Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal Credentials

Gbhackers •Mayura Kathir • September 7, 2026

A large-scale phishing operation is abusing trusted Google services as a multi-stage redirect network to bypass email security controls, deliver highly personalized credential-harvesting pages, and, in some cases, install ScreenConnect remote-access software. The campaign’s central advantage is that it presents trusted Google-owned domains at nearly every point a gateway, proxy, or analyst is likely to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Global Phishing Campaign Exploits Google Services for Credential Theft A large-scale phishing campaign is leveraging trusted Google infrastructure to bypass email security measures and steal credentials. The operation uses a multi-stage redirect network that includes six distinct Google services, making it difficult for security systems to detect malicious activity. Victims are presented with highly personalized credential-harvesting pages that dynamically pull company logos and screenshots to appear legitimate. In some instances, the campaign also installs remote access tools like ScreenConnect. The attack targets both everyday users and organizations, exploiting their trust in Google's services. The campaign's sophistication allows it to evade detection by security gateways, which expect to see trusted domains at every stage. As of now, the campaign is active and continues to evolve, posing a significant threat to users and organizations alike. 6 sources 70

Extracted Entities

Global Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal Credentials

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)

Tools (1)