A new phishing campaign is exploiting Google's own services as relay points. The attackers string together multiple Google redirect hops, so the link a victim clicks passes through several legitimate Google properties before reaching the final malicious page. This layering is designed to confuse automated scanners that check URLs against known blocklists.
The endgame varies depending on the target. Some victims are led to a fake login page that harvests their credentials, while others are steered toward installing ScreenConnect, a legitimate remote access tool that the attackers then use to control the compromised machine. Using a trusted tool like ScreenConnect lets the operators blend in with normal software usage.
Because the redirects ride on Google's domains, the campaign exploits the general assumption that anything coming from google.com is safe. Security vendors and email filters often whitelist such domains, which is exactly the gap these attackers are probing. The report does not indicate the scale of the campaign or name specific victims, but it underscores how abusing trusted infrastructure remains an effective evasion tactic.