[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7sDiyxM3EU1-KeEs-N2Vh9XeuT9wnycVLG2Zm_cmGUU":3},{"article":4,"iocs":41},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":28},"60214180-eb3c-4395-92c5-7f2fde115cfb","Attackers Use Multi-Hop Google Redirects for Phishing Campaign","attackers-use-multi-hop-google-redirects-for-phishing-campaign-dacffe","Threat actors are abusing multiple Google services to evade detection, ultimately harvesting credentials or installing ScreenConnect remote access.","Threat actors are employing a sophisticated phishing campaign that leverages multiple Google services to create a chain of redirects, making it harder for security teams to detect and block. This multi-hop approach ultimately leads victims to pages designed to steal credentials or deploy ScreenConnect for remote access.","Attackers use multi-hop Google redirects for phishing, harvesting credentials or installing ScreenConnect.",null,"https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fattackers-multi-hop-google-redirects-phishing-campaign","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt03ee880bdb37bd5a\u002F6aa06071aa16bb4982ce6be0\u002Fhopscotch-LeoPatrizi-GettyImages-1303877346.jpg?width=720&quality=80&disable=upscale","2026-09-08T21:03:46+00:00","2026-09-08T22:00:08.367127+00:00",7,[18,21],{"name":19,"type":20},"Google","vendor",{"name":22,"type":23},"ScreenConnect","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":24,"icon":11,"name":26,"slug":27},"Threat Intelligence","threat-intelligence",[29,34,39],{"category":30},{"id":31,"icon":11,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":36,"icon":11,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":24,"icon":11,"name":26,"slug":27},[42],{"type":38,"value":22,"context":43},"Remote access tool deployed by attackers"]