Press play to start listening
Cybersecurity researchers from NordVPN have identified a phishing platform that uses a live Google login session to steal passwords and two-factor authentication codes from victims.
The campaign starts with an email designed to look like a Google Voice voicemail alert. The messages are sent from compromised legitimate accounts, which can help them pass standard email authentication checks.
NordVPN’s threat intelligence unit first identified executives/CEOs as the key targets, but the team later found that phishing emails were not limited to them and employees at other organizations were targeted as well.
Attackers Relay Real Google Login Pages
The link takes victims to the real Google login page, but the page is running in a browser controlled by the attackers and streamed to the victim. Anything entered on the page, including the password and two-factor authentication code, passes through the attackers’ server. This technique, called browser-in-the-middle (BiTM), also gives the attackers access to the authenticated session.
Researchers explained that a one-time code may not be enough to stop the attack, since the attackers can use the session after the victim has completed the login. “Everything they type, including the security code,” goes straight to the attacker, noted Marijus Briedis, CTO at NordVPN, in the research findings shared with Hackread.com.
Human Operators Behind the Attack
NordVPN found that the platform includes a control panel where human operators can monitor and interact with victims’ sessions. They can respond when a login fails or when another security prompt appears. Session tokens containing campaign and project identifiers also indicate that the infrastructure is being used as phishing-as-a-service (PhaaS).
Additionally, the platform attempts to stay hidden from automated analysis by using Cloudflare Turnstile checks. NordVPN said its automated access attempts were blocked during testing.
The same infrastructure also runs a separate push-notification scam in which victims are shown a fake “Subscription confirmed” page displaying a hard-coded count of 22,726 subscribers and are encouraged to allow browser notifications. Accepting them gives attackers a channel for sending future notifications.
NordVPN researchers reconstructed the attack by examining network captures, JavaScript, service workers, screenshots, and browser automation. They also analyzed session tokens and the platform’s client-side code.
Google Services Becoming Frequent Targets
Google’s popularity and broad range of products make its services attractive targets for abuse. Over the years, hackers have exploited trusted platforms and services such as Google Ads, Google Drive, Chrome, and other Google products to facilitate phishing, malware distribution, credential theft, and attacks at varying scales.
Attackers have also increasingly exploited the popularity of the company’s AI platforms, including Gemini AI, as lures in phishing and social engineering campaigns.
Users should adopt phishing-resistant authentication methods, such as passkeys or hardware security keys, wherever available. Unlike one-time verification codes, these methods are considerably harder for attackers to intercept and exploit during real-time phishing attacks.
