Cybercriminals Exploit Multi‑Stage Google Redirects to Bypass Defenses

Security researchers have identified a new phishing scheme that leverages a series of redirects through Google services to conceal malicious payloads, allowing attackers to harvest login credentials or deploy the ScreenConnect remote‑access tool on compromised machines.

The approach begins with a seemingly innocuous Google URL—often a shortened link or a shared document reference—that automatically forwards the user to another Google service, such as Google Docs, Drive, or Forms. Each subsequent hop adds a layer of legitimacy, ultimately landing the victim on a counterfeit login page or a download prompt that appears to originate from a trusted source.

Because each redirect passes through a Google domain, traditional email filters and web‑gateway protections that rely on domain reputation are less likely to flag the traffic. Once the user submits credentials or executes the downloaded ScreenConnect installer, the adversary gains the ability to move laterally within the target network, exfiltrate data, or maintain persistent remote control.

Phishing attacks have long co‑opted reputable platforms to improve deliverability, but the multi‑hop technique represents a refinement that complicates detection. By chaining several Google services, threat actors create a breadcrumb trail that evades single‑point URL analysis, forcing defenders to examine the full redirect chain rather than the initial link alone.

The campaign was first reported by Dark Reading, which highlighted the need for organizations to tighten URL inspection, enforce multi‑factor authentication, and educate users about the risks of unexpected Google links. Security vendors are updating threat‑intelligence feeds to include the specific redirect patterns observed in this operation.

Analysts expect the tactic to proliferate as attackers seek new ways to exploit the trust placed in cloud services. Experts advise continuous monitoring of outbound traffic for unusual Google redirect sequences and the deployment of endpoint protections that can block the installation of unauthorized remote‑access tools like ScreenConnect.