Hackers Using Fake Google Meet Pages to Steal Google Credentials

Two websites are hosting fake Google Meet pages designed to steal Google account credentials and carry out phishing involving two-factor authentication (2FA), according to threat intelligence shared on October 20, 2026.

The pages imitate a familiar meeting service to make a request for account details look more believable. The researcher also reported a serious security issue on an exposed /install page: it reveals database configuration information and a prefilled database password.

The source does not disclose the password itself. Analysts say this case highlights a risk that goes beyond a lookalike sign-in page. If a user enters a password or verification code on a fake site, criminals may be able to use those details to try to access the account.

The available report does not provide a full account of the page’s design, how victims reach it, or whether any accounts were confirmed stolen.

Anurag (@Malwarehunterr) identified and noted the campaign in a post describing the two domains, the exposed installation page, and the related web paths.

Hackers Using Fake Google Meet Pages

Google Meet is commonly used for work meetings, classes, and personal calls, so a page that looks like a meeting link may not raise immediate concern.

The two domains reported in this case are meet-google[.]cyou and qooglo[.]com. Their names resemble Google-related terms, but neither is the genuine meet.google.com domain.

Users should check the complete website address before entering a password, even when the page uses familiar logos or meeting language.

The researcher’s post describes the pages as designed to steal Google credentials and facilitate 2FA phishing. It does not spell out the exact steps in the sign-in process or explain whether the site relays authentication in real time.

In general, a stolen password can put an account at risk; a captured verification code may add further danger if criminals use it quickly.

Google advises users to choose stronger verification options, such as security keys or Google prompts, and says passkeys are designed to resist phishing.

This matters because an account can hold more than email. Depending on the user’s settings and connected services, access may expose documents, contacts, saved information, or business data.

A successful sign-in can also help a criminal send believable messages from the victim’s account. Google recommends reviewing recent security events and devices if a user suspects unauthorized access. For more background on how attackers can target Google sign-ins and authentication, readers can see this report on a Google account phishing kit.

Exposed installation page raises a separate concern

The reported /install page adds a second issue to the credential theft risk. According to the post, visiting that path exposes database configuration and a prefilled database password.

Such information may help an unauthorized visitor understand how a site’s backend is set up. The report does not say whether the exposed details were used to access the database, and the password value is not included in the source.

A misconfigured setup page should not be publicly available with sensitive information filled in. Site operators should restrict access to installation and setup routes, remove default or prefilled secrets, and review whether any credentials displayed on the page remain valid.

If they do, they should be changed and any systems using them checked. These are practical defensive steps based on the exposure described; the available report does not confirm what response the site owners have taken.

The report also lists web paths associated with the campaign: /meet, /assets/js/demo.js, /api/demo/sessions, /api/demo/sessions/{token}, and /api/demo/sessions/{token}/resend.

These paths may help defenders search relevant web logs, but a path alone does not prove that a system or user has been compromised. The source does not provide a sample file, malware name, IP address, or cryptographic hash.

Lookalike services remain a common theme in phishing. Cybersecurity News has previously reported on a Gmail phishing login flow that sought account details, and on fake Google Forms pages used to collect credentials.

A separate campaign used a fake Meet page to push a malicious command rather than simply request a password, as described in this Google Meet ClickFix report. Those reports describe different campaigns; they should not be treated as evidence that the same operators are behind this one.

Users should open Google Meet by typing its known address or using a trusted calendar invitation, rather than signing in through an unexpected page.

Check the full domain carefully: a padlock or HTTPS connection only means the connection is encrypted, not that the site belongs to Google. Do not enter a password or 2FA code after following an unfamiliar link.

Anyone who may have entered credentials should change the Google password through Google’s official account page, review recent security events, and remove unfamiliar devices or sessions.

If the password was reused elsewhere, change it on those services too. Google’s guidance explains how to secure a compromised account and review account activity. Organizations should also check sign-in logs for suspicious access and alert staff to the reported domains and paths.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Using Fake Google Meet Pages to Steal Google Credentials appeared first on Cyber Security News.