Google Infrastructure Abused to Hide a Global Phishing Campaign

Summary

A sophisticated global phishing campaign abuses legitimate Google services to bypass security gateways through multi-hop redirect chains. These trusted domains conceal the final destination, which may lead victims to a credential harvester or remote access tool installer. The phishing infrastructure dynamically profiles targets and impersonates their specific organization in real time to improve conversion and credential theft success.

Investigation

The investigation examined redirect chains involving services such as Google Meet, Search, and Tag Manager. Researchers found that victim email addresses are encoded within URL fragments to avoid server-side logging. The campaign also uses automated profiling through IP and geolocation APIs, along with MX record verification, to identify targets and filter out security researchers and sandbox environments.

Mitigation

Defenders should block identified malicious domains across DNS, proxy, and SIEM controls. Organizations should monitor for unauthorized ScreenConnect installations and anomalous Telegram Bot API traffic. Google redirect protections should also be expanded to cover potentially abused endpoints, including Tag Manager and Analytics debug parameters.

Response

If phishing activity is detected, organizations should force credential resets for affected users and hunt for unauthorized remote monitoring tools. Security teams should investigate web traffic containing URL fragments with base64-encoded data. Malicious URLs should also be reported promptly to Google Safe Browsing to support faster detection and takedown efforts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary is in the reconnaissance phase of a phishing campaign. To ensure their spoofed emails reach the target, they need to verify the target’s Mail Exchange (MX) records. To avoid triggering internal DNS monitoring or being caught by simple DNS inspection, they use a PowerShell script to perform a DNS-over-HTTPS (DoH) query. The script targets https://dns.google/dns-query, appending the specific domain they wish to investigate. This creates a network connection to a Google-owned IP with a URL pattern that matches the detection rule.

• Regression Test Script:

  # Simulation: Perform a DoH query to Google to check MX records for 'example.com'
  # This is designed to trigger the detection rule via the '.google/dns-query' pattern.
  
  $targetDomain = "example.com"
  $dohUrl = "https://dns.google/dns-query?name=$targetDomain&type=MX"
  
  Write-Host "[+] Initiating DoH query to Google API for $targetDomain..."
  try {
      $response = Invoke-RestMethod -Uri $dohUrl -Method Get
      Write-Host "[+] Query completed successfully."
      $response | ConvertTo-Json | Write-Host
  } catch {
      Write-Host "[-] Query failed: $_"
  }

• Cleanup Commands:

  # No persistent artifacts are created by the DoH query.
  # Ensure no temporary files were created if the script was modified.
  Remove-Item -Path "$env:TEMPdoh_test.tmp" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete. No artifacts remaining."