Phishing hops through six Google domains to beat filters

Domain reputation is the control most email gateways lean on hardest, and this phishing campaign never leaves a domain your gateway trusts until the last hop. The KnowBe4 Threat Lab documented operators chaining open redirects across Google's own infrastructure to move a victim from an inbox to a credential harvester — or to a working remote-access install.

What actually happened

The chain uses redirect endpoints on meet.google.com/linkredirect, www.google.com/url?q=, adservice.google.com DoubleClick click tracking, cse.google.com/url?q=, regional images.google.com variants, googletagmanager.com/debug/clearcookies?url=, and Analytics with a dl= parameter. A single lure can move through three Google hops before it reaches attacker infrastructure. Every one of those is a domain your proxy allowlist, your URL scanner and your firewall already trust.

The targeting trick is better than the redirect trick. The victim's email address is encoded in the URL fragment — everything after the #. Browsers strip fragments before sending the request, so the pre-targeted address never appears in server logs or in scanner telemetry. The link looks generic to your tooling and arrives pre-filled to the victim.

Lures impersonate DocuSign and SafeSend document reviews, Microsoft 365 credential-expiry notices, FedEx tracking, QuickBooks and OneDrive payment alerts, Social Security benefit notices, and Microsoft voicemail. Targets span manufacturing, government, finance and non-profits. Two payload tracks follow: a high-fidelity Microsoft sign-in page (or device-code interception), or a fake identity-verification prompt that installs ScreenConnect — legitimate remote monitoring software, used here as a persistent backdoor.

Why it matters for your business

This is the second ScreenConnect story this week, after the rogue-client worm ConnectWise is still patching. Different entry point, same endgame: a signed, legitimate RMM binary is a cheaper backdoor than malware, and it survives your EDR because it is supposed to be there.

The practical shift is that "the link goes to google.com" is now worthless as a safety signal, for your filters and for your staff. Three things are worth doing this week. Hunt your endpoints for ScreenConnect installs nobody authorized — an inventory query, not a project. Block the specific Google redirect endpoints KnowBe4 lists at the proxy; almost no business workflow needs googletagmanager.com/debug/clearcookies. And check whether your gateway logs the full URL including fragments, because if it does not, your incident timeline will be missing who was targeted.

Source: KnowBe4 Threat Lab: Bypassing the Gatekeepers.