GTFire Phishing Scheme Abuses Google Services to Evade Detection and Steal Credentials

A new phishing campaign called GTFire is abusing two of Google’s most trusted services — Firebase and Google Translate — to harvest login credentials from victims around the world.

What makes this campaign dangerous is its ability to hide malicious activity behind legitimate Google-owned domains, allowing phishing links to pass through email filters and web security gateways without triggering alerts.

Victims land on convincing brand-impersonating login pages, submit their credentials, and are then quietly redirected to the targeted brand’s legitimate website, unaware that their data was already stolen.​

The scale of GTFire is striking. Exposure of attacker-controlled command-and-control (C2) servers revealed thousands of stolen credentials connected to more than 1,000 organizations in over 100 countries and across more than 200 industries.

Mexico leads the victim count with 385 confirmed victims — predominantly in manufacturing, education, and government — followed by the United States (101), Spain (67), India (54), and Argentina (50).

Group-IB analysts identified the campaign as a well-organized, large-scale credential harvesting operation.

Researchers noted that attackers reuse phishing templates across multiple brand targets with minimal changes, enforcing a deliberate multi-step credential collection flow while managing centralized servers that store stolen data organized neatly by date, language, and targeted service.

Over 120 unique phishing domains were identified, all following high-volume naming patterns designed to enable rapid infrastructure rotation.​

The reach of GTFire clearly extends well beyond any single region. Threat actors carefully adapt each phishing page to display the visual identity of a targeted brand, making fake login portals look indistinguishable from real ones.

After a victim submits credentials, the seamless redirect to the legitimate brand website delays any awareness that an attack has occurred, buying attackers more time before detection.​

GTFire surfaces a troubling reality for defenders — trusted infrastructure can be weaponized with very little effort.

Traditional URL-reputation checks and static blocklists struggle to catch phishing links hosted on Google-owned domains. Brand abuse remains one of the most potent social engineering vectors, and GTFire shows just how efficiently it can be deployed globally.​

How GTFire Chains Google Services to Steal Credentials

The attack begins when a victim receives a phishing message containing a Google Translate link (translate.goog).

This URL acts as an invisible relay, routing the request through Google’s translation proxy infrastructure before landing the victim on a Firebase-hosted phishing page.

Since the link belongs to a Google-owned domain, email security gateways and web filters rarely intercept it.

Firebase hosts the final phishing pages, with attackers registering large numbers of randomly named *.web.app subdomains and rotating them frequently to outpace blocklists.

Each page dynamically loads brand-specific logos and login fields using a reusable phishing framework with only minor cosmetic changes per target.

When a victim submits their username and password, the page displays a fake “incorrect password” error and prompts them to try again. Both entries are silently captured in the background.​

Stolen credentials are sent to attacker-controlled C2 servers via HTTP GET requests, with passwords Base64-encoded alongside metadata including the victim’s country and browser language.

The C2 backend runs on LiteSpeed Web Server instances using PHP-based All-in-1.php collection scripts — commercially available tools that reduce operational overhead and accelerate deployment.

Organizations should implement phishing-resistant multi-factor authentication and train employees to recognize Google-based phishing techniques.

Security teams should build detection rules that flag URL patterns combining translate.goog with *.web.app domains and monitor trusted cloud platforms for brand impersonation.

Sharing indicators of compromise — including network IOCs jnhwzs..fyi and gnpnia..lat, and file-based IOC All-in-1.php collection scripts — with CERT communities remains critical in containing this campaign.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.