---
title: Phishing Links Are Hiding Inside Google's Own Trusted Domains
description: KnowBe4 found a live campaign that clears email gateways, harvests credentials, and installs ScreenConnect. The tell is buried in the URL.
canonical_url: https://codekeeper.co/ticker/attackers-exploit-google-services-for-phishing
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Phishing Links Are Hiding Inside Google's Own Trusted Domains

KnowBe4 found a live campaign that clears email gateways, harvests credentials, and installs ScreenConnect. The tell is buried in the URL.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Sep 9, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

KnowBe4 published research on September 4 into a phishing campaign still running in the wild, and the trick sits in the link. Rather than hide a malicious URL and hope the gateway misses it, the operators built a three-hop redirect chain from Google's own services, so every hop an inspector checks resolves to a domain it already trusts. The services named include Google Meet, DoubleClick, Custom Search, Image Search, Tag Manager, and Analytics. What waits at the end varies: some victims get a fake corporate login page, others a fake identity verification prompt that quietly installs ScreenConnect for remote access. The login page is the more inventive half. JavaScript builds it on the fly from the victim's email address alone, sets a live screenshot of their real corporate website behind it, and localizes the interface to their location. Credentials reach the operator's Telegram channel within seconds, along with the victim's IP, geolocation, browser string, and their organization's verified MX records. KnowBe4 wants the IOCs blocked at DNS filter, proxy, and SIEM level now, Telegram bot API traffic hunted, unauthorized ScreenConnect installs checked, and credential resets forced for anyone who may have received a lure. An email address after the # in a URL signals a pre-targeted link, though it is base64-encoded, so nobody will spot one by eye. **Source:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fattackers-exploit-google-services-for-phishing%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Vulnerabilities Critical isolated-vm Flaw Lets Untrusted JavaScript Escape Sandbox Aug 24, 2026](https://codekeeper.co/ticker/node-js-sandbox-escape-vulnerability)

[Cyberattacks Trivy Compromise, Not LiteLLM, Drove Most of the March Supply Chain Exposure Aug 17, 2026](https://codekeeper.co/ticker/trivy-scanner-supply-chain-attack-impact)

[Hackers Are Actively Exploiting a Critical VeloCloud Orchestrator Vulnerability Aug 11, 2026](https://codekeeper.co/ticker/critical-velocloud-flaw-cve-2026-16812)

[Cyberattacks Ceva Logistics Cyberattack Disrupts European Operations, Exposes Customer Data Aug 26, 2026](https://codekeeper.co/ticker/ceva-logistics-cyberattack-disrupts-operations)