GTFire Phishing Campaign Exploits Google Services to Steal Credentials A newly uncovered phishing campaign, dubbed GTFire, is leveraging trusted Google services including Firebase and Google Translate to bypass security defenses and harvest user credentials on a global scale. Discovered by cybersecurity firm Group-IB, the campaign exploits Google’s infrastructure to host malicious login pages and disguise phishing URLs. Attackers use Firebase’s .web.app subdomains, which are commonly associated with legitimate development projects, to host fake login pages that mimic corporate branding. Meanwhile, Google Translate acts as a proxy, cloaking phishing links within the translate.goog domain to evade detection by email and web security filters. The attack follows a multi-step redirection process, making it difficult for security systems to flag malicious activity. Once victims land on the Firebase-hosted phishing page, they are prompted to enter credentials, with incorrect attempts triggering repeated login prompts to maximize data collection. Stolen credentials are Base64-encoded and transmitted via HTTP GET requests to attacker-controlled command-and-control (C2) servers, along with metadata such as the victim’s email, location, and browser language. The campaign employs pre-packaged PHP phishing scripts hosted on LiteSpeed Web Servers, enabling rapid scaling without custom development for each target. Group-IB’s research indicates the operation is highly organized, with stolen data segmented by date, brand, and language. GTFire highlights the growing trend of threat actors abusing trusted cloud services to evade detection, underscoring the need for organizations to reassess traditional security trust models.