Back Cybersecuritynews

GTFire Phishing Scheme Abuses Google Services to Evade Detection and Steal Credentials

Cybersecuritynews •Tushar Subhra Dutta • March 2, 2026

A new phishing campaign called GTFire is abusing two of Google’s most trusted services — Firebase and Google Translate — to harvest login credentials from victims around the world. What makes this campaign dangerous is its ability to hide malicious activity behind legitimate Google-owned domains, allowing phishing links to pass through email filters and web […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GTFire Phishing Campaign Exploits Google Services for Credential Theft The GTFire phishing campaign is leveraging Google services, specifically Firebase and Google Translate, to steal login credentials from users globally. By disguising malicious links within trusted Google domains, the campaign effectively bypasses email filters and web security measures, increasing its reach and impact. 3 sources 31

Extracted Entities

GTFire Phishing Scheme Abuses Google Services to Evade Detection and Steal Credentials

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (2)