Large-Scale Phishing Campaign Abuses Google Services to Bypass Security Controls A sophisticated phishing operation is leveraging trusted Google services including Google Meet, Search, DoubleClick, Custom Search, Image Search, Tag Manager, and Analytics to evade email security defenses and deliver highly personalized credential-harvesting pages. In some cases, the attack also deploys ScreenConnect, a legitimate remote-access tool, to establish persistent access to compromised systems. ### How the Attack Works The campaign exploits Google’s redirect and tracking infrastructure to mask malicious URLs behind legitimate domains, delaying exposure of the final phishing destination until after initial security scans. Attackers use multiple URL permutations, such as: - Google Meet’s `linkredirect` endpoint - Google Search and DoubleClick click-tracking URLs - Google Custom Search and regional Image Search domains - Tag Manager debug functionality and Analytics parameters Victims are lured with brand-impersonation emails mimicking DocuSign, Microsoft, OneDrive, FedEx, Intuit QuickBooks, and government services, exploiting routine business workflows. A key evasion tactic involves URL hash fragments containing the victim’s Base64-encoded email address, which remains hidden from server-side logs and many URL-scanning tools. After navigating the redirect chain, victims land on attacker-controlled `.vu` domains, compromised sites, or Cloudflare Workers endpoints. Some pages display fake CAPTCHAs or interstitial messages to thwart automated analysis. ### Personalized Phishing Pages & Credential Theft The phishing kit dynamically customizes pages using the victim’s email address, pulling: - Company logos (via Clearbit or Google’s favicon service) - Live screenshots of the target organization’s public website - Localized interfaces in 16 languages - Pre-filled email fields and browser tab titles matching the victim’s company The kit also profiles victims by collecting: - IP addresses & geolocation data - Browser fingerprints & language settings - MX records (to verify corporate email domains and filter out researchers/sandboxes) ### Two Monetization Paths 1. Credential Harvesting - Fake Microsoft 365 or OneDrive portals capture passwords, with some variants forcing a second password submission before redirecting to the real corporate site. - Stolen credentials, along with IP, location, and browser details, are exfiltrated to an attacker-controlled Telegram bot. 2. ScreenConnect Deployment - Fake document-access or identity-verification prompts install ScreenConnect, granting attackers persistent remote access bypassing MFA and password resets. ### Targeted Sectors & Lures The campaign focuses on manufacturing, government, finance, and non-profits, using lures such as: - Expired credentials (Microsoft 365) - FedEx delivery notifications - QuickBooks payment alerts - Social Security or voicemail messages ### Known Infrastructure & IOCs Security researchers have identified multiple malicious domains and endpoints, including: - `vazquezfleytas[.]com` (credential harvester) - `zh-l-haixing[.]com` (credential harvester) - `.vu` domains (e.g., `cloudbemismanufacturingcompanygroup[.]rydezyhrsysteminc[.]vu`) - Compromised sites (e.g., `odahlzr5lm[.]reliabilityinoperations[.]de`) - Malicious Cloudflare Workers endpoints The operation demonstrates how attackers abuse trusted cloud services to bypass security controls while delivering highly convincing, personalized phishing attacks.

Intuit Inc. reported a potential unauthorized access to a TurboTax account on May 9, 2025. The breach involved an unauthorized party accessing the account using the user's credentials, potentially exposing sensitive information such as Social Security numbers and financial data. The number of individuals affected is currently unknown.

Intuit Inc. reported a potential unauthorized login to a TurboTax account on February 12, 2025. The unauthorized access may have exposed personal information, including names, Social Security numbers, and financial information, although the exact number of affected individuals is unknown. Intuit has secured the account and is offering one year of free identity protection services through Experian IdentityWorks.

On December 20, 2024, the Maine Office of the Attorney General reported a data breach involving Intuit Inc. that occurred on March 5, 2024. An unauthorized access incident involved one affected individual, with potential exposure of sensitive information from TurboTax accounts. Intuit offered a 12-month membership for Experian IdentityWorks for identity theft protection services.

On March 15, 2024, the Maine Office of the Attorney General reported a data breach involving Intuit Inc. The breach, which occurred between December 23, 2023, and February 21, 2024, involved unauthorized access to a TurboTax account, potentially compromising the individual's Social Security number. Affected individuals were provided with a 12-month membership to Experian IdentityWorks for identity theft protection.

On September 15, 2023, the Maine Office of the Attorney General reported that Intuit Inc. experienced an account takeover (ATO) incident affecting one individual. The breach occurred between January 2, 2023, and July 26, 2023, resulting in unauthorized access to a TurboTax account, potentially exposing personal information, including driver's license numbers.

Financial software company Intuit discovered that tax return info was accessed by an unauthorized party after an undisclosed number of TurboTax tax preparation software accounts were breached in a credential-stuffing attack. Following the discovery of the security breach, Intuit decided to temporarily disable the TurboTax accounts which were breached in the credential stuffing attack. The company also provides one year of free identity protection, credit monitoring, and Experian Identity Works identity restoration services to customers impacted by the data breach to further protect their TurboTax accounts. The company stated that there was no data breach of Intuit’s systems or any third party accessing Intuit systems.

The California Office of the Attorney General disclosed a data breach affecting Intuit’s TurboTax platform in April 2015. Unauthorized actors gained access to user accounts between February 1, 2014, and February 27, 2015, potentially compromising prior-year tax return information. While the exact number of affected individuals remains undisclosed, the breach exposed sensitive financial data, including tax filings, which could enable identity theft, fraudulent tax submissions, or financial exploitation. The incident highlighted vulnerabilities in account security, raising concerns over the protection of user data within tax preparation services. Intuit did not confirm whether the breach resulted in direct financial losses for users, but the exposure of tax-related data poses significant risks to personal and financial security.