Multi-Stage Phishing Attacks Now Use Google Infrastructure—Here’s How

Daily Security Review

Recent phishing campaigns have entered a new phase—one where trust is weaponized. In this episode, we break down how cybercriminals are exploiting legitimate services like Google Apps Script and Google Firebase Storage to host phishing pages, evade detection, and steal credentials. Using cleverly crafted lures such as fake DocuSign notifications, invoice alerts, and even deceptive CAPTCHA prompts, these attackers are bypassing traditional email and web filters by operating under the guise of reputable platforms.

We’ll dive into specific attack techniques, including multi-stage payload delivery using VBScript, clipboard hijacking with fake MP3 files, and the deployment of tools like NetBird and OpenSSH for persistent access. We’ll also explore the rise of Phishing-as-a-Service kits like Haozi that lower the barrier for launching these sophisticated campaigns. Finally, we cover key mitigation strategies—from detection platforms to user education—that organizations can adopt to stay ahead of these evolving threats.

This episode is a must-listen for IT professionals, CISOs, and anyone tasked with defending against phishing and social engineering attacks in today’s high-trust, high-risk digital landscape.