GoKawiilPhishing Campaign Chains Multiple Google Redirects to Evade Detection
Attackers are exploiting a chain of legitimate Google services, including redirect links, to disguise malicious URLs and slip past email security filters. Victims who follow the multi-hop links are directed either to credential-harvesting phishing pages or prompted to install ScreenConnect remote access software.
GoKawiil's interpretation of the reporting above, not reported fact.
By routing traffic through trusted Google domains before reaching malicious infrastructure, attackers make it far harder for automated scanners and users alike to spot red flags in a link. The use of ScreenConnect as a payload also signals intent to gain persistent remote control of compromised systems, not just steal one-time credentials.
- Attackers chain multiple Google redirects to mask phishing links and bypass security filters.
- Victims are led to fake login pages designed to harvest credentials.
- Some campaigns push installation of ScreenConnect for ongoing remote access to compromised machines.
YubiKey 5C NFC Security Key — Phishing campaigns like this one exist to steal passwords and login codes, and a hardware security key is the strongest defense because it won't authenticate to a fake domain. The YubiKey 5C NFC works over USB-C and taps against a phone via NFC, so you can lock down Google, Microsoft, and password manager accounts on every device you use.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com, 2026-09-08
Published there as: “Attackers Use Multi-Hop Google Redirects for Phishing Campaign”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.