Security News Hackers Exploit Free Firebase Accounts to Launch Phishing Campaigns

[Brownie2019]

Content source

https://gbhackers.com/hackers-exploit-free-firebase-accounts/

A new wave of phishing campaigns where scammers are abusing Google’s legitimate infrastructure to bypass security filters.
Attackers are now creating free developer accounts on Google Firebase to send fraudulent emails that impersonate well-known brands.
By leveraging the reputation of the Firebase domain, these attackers are successfully landing in users’ inboxes, bypassing standard spam detection systems.

How the Attack Works

More on:

Hackers Exploit Free Firebase Accounts to Launch Phishing Campaigns

A new wave of phishing campaigns where scammers are abusing Google’s legitimate infrastructure to bypass security filters.

gbhackers.com

 

[Bot]

More on:

Hackers Exploit Free Firebase Accounts to Launch Phishing Campaigns

A new wave of phishing campaigns where scammers are abusing Google’s legitimate infrastructure to bypass security filters.

gbhackers.com

This is a good example of “living off trusted infrastructure”: the attacker isn’t relying on an obviously sketchy domain or mail server, but on a legitimate Google-owned platform (Firebase) so basic reputation-based filters are less effective.

What this means in practice

• The email (or the phishing landing page) can be hosted/sent using Google-controlled domains and IP space, which often has a strong reputation.
• Because the infrastructure looks “legit” at a glance, users may trust it, and some mail security stacks may score it as lower risk than a typical throwaway domain.
• This does NOT mean Google/Firebase is “compromised” in the classic sense—more commonly it’s abuse of free/low-friction signups plus weak enforcement gaps that attackers take advantage of.

What to look for in these emails (user-side checks)

• Brand mismatch: the message claims to be from a bank/parcel provider/streaming service, but the technical sender/links are Google/Firebase-related.
• Link destination: hovering the button shows a Firebase-hosted URL (often on firebaseapp.com or web.app) or a Google storage/hosting URL, rather than the brand’s real domain.
• “Urgency + action” patterns: “Account locked,” “Payment failed,” “You have a refund,” “Unusual login,” paired with a login button.
• Requests for credentials, MFA codes, or “confirm your wallet/seed phrase” (always a red flag).

Safer handling steps (individuals)

• Do not click the embedded button/link. Instead, open the company’s site/app by typing it yourself or using a known bookmark.
• Use your mail client’s “Report phishing” feature (in Gmail/Outlook/etc.). This helps train detection and can trigger takedown workflows.
• If you already clicked:
  • Do not enter credentials.
  • If you entered credentials, change the password immediately (from a clean device/browser) and enable MFA/2FA if it isn’t already on.
  • Review account security activity (recent logins/sessions) and revoke unknown sessions/tokens where possible.
• If you want a second opinion on a suspicious URL or attachment, submit it to VirusTotal (do not upload sensitive documents).

Mitigations for orgs / admins

• Treat “hosted on a reputable cloud domain” as neutral, not automatically safe. Add detections for brand impersonation + credential-harvest patterns regardless of hosting.
• Enable URL rewriting and time-of-click protection (where available), plus attachment sandboxing.
• Harden authentication: phishing-resistant MFA (passkeys/FIDO2) significantly reduces the value of stolen passwords.
• User training: specifically teach that “Google/Microsoft hosted” does not equal “legitimate brand email.”
• Consider policies to warn or quarantine emails that contain login links to common “free hosting” platforms when the sender claims to be a different brand (tune carefully to avoid false positives).

Bottom line
Firebase (and similar services) can be abused to make phishing look more credible and to slip past simplistic reputation checks—so the practical defense is verifying the real destination and using phishing-resistant authentication, not trusting a message just because it uses a well-known cloud platform.

 

[Divergent]

Technical Analysis & Remediation

Threat Profile & MITRE ATT&CK Mapping
The campaign abuses the "Free Tier" of Google Firebase to acquire infrastructure and deliver payloads. This is a configuration and service abuse issue, not a software vulnerability (CVE).

T1583.006 (Acquire Infrastructure: Web Services) Actors register free Firebase accounts to host content.

T1566.002 (Phishing: Spearphishing Link) Malicious emails contain links to Firebase-hosted pages.

T1098.004 (Account Manipulation
SSH Authorized Keys): (Note: Related campaigns have used similar tactics to install NetBird/OpenSSH, though this specific campaign focuses on credential harvesting).

T1102 (Web Service)
Abuse of legitimate Google infrastructure for C2 or exfiltration.

Live Evidence Extraction (IOCs)

Sender Identities (Firebase Subdomains)

noreply[@]pr01-1f199.firebaseapp[.]com

noreply[@]pro04-4a08a.firebaseapp[.]com

noreply[@]zamkksdjauys.firebaseapp[.]com

Network Artifacts (Redirects & Hosting)

clouud.thebatata[.]org (Malicious redirector)

rebrand[.]ly (URL Shortener used to mask destination)

Remediation - THE ENTERPRISE TRACK (SANS PICERL)

Phase 1: Identification & Containment

Query Email Logs
Hunt for any inbound mail from *.firebaseapp.com. While legitimate apps use this, it is rare for legitimate business-to-business communication to originate solely from a raw Firebase subdomain.

Block & Alert
Implement a quarantine rule for the specific subdomains identified (pr01-1f199, pro04-4a08a) and consider a temporary block on firebaseapp.com sender domains if your organization does not rely on them for app notifications.

Sinkhole DNS
Block resolutions for clouud.thebatata[.]org at the DNS resolver level.

Phase 2: Eradication

Purge Phishing Emails
Use PowerShell (Exchange Online) or API tools to hard-delete identified emails from user inboxes to prevent "late clicks."

Reset Credentials
For any user who clicked a link, force an immediate password reset and revoke active sessions.

Phase 3: Recovery

Tune SEGs
Update spam filter scoring to penalize "free tier" cloud domains (e.g., *.herokuapp.com, *.firebaseapp.com, *.workers.dev) when they appear in the From header without DMARC/DKIM alignment with a known corporate domain.

Phase 4: Lessons Learned

Update Awareness Training
Specifically highlight that "legitimate Google links" does not mean "safe content." Attackers use trusted infrastructure to lower victim suspicion.

Remediation - THE HOME USER TRACK

Priority 1: Safety (Immediate Action)

Do Not Click
If you receive an email from a major brand (e.g., your bank, Netflix) but the sender address ends in firebaseapp.com, it is a scam. Legitimate companies send from their own domains (e.g., @netflix.com), not Google's developer domains.

Mark as Phishing
Use your email provider's "Report Phishing" button. This helps train Google's filters to catch these specific subdomains.

Priority 2: Identity

Credential Audit
If you clicked a link and "logged in," you must change that password immediately. Enable 2-Factor Authentication (2FA) on the compromised account.

Priority 3: Persistence

Check Linked Apps
This campaign primarily harvests credentials, but always ensure no unknown "Connected Apps" were authorized in your Google or Microsoft account settings during the panic.

Hardening & References

Baseline
CIS Benchmark for Google Workspace (Ensure external sender warnings are enabled).

Tactical
NIST SP 800-177 (Trustworthy Email) – Section 4.1 on sender authentication.

Reference

GBHackers Security

NIST (National Institute of Standards and Technology)

SP 800-177 (Trustworthy Email)
Guidelines for detecting and preventing email spoofing (SPF/DKIM/DMARC alignment).

SP 800-61r2 (Computer Security Incident Handling Guide) The standard lifecycle used for the remediation tracks.

CIS (Center for Internet Security)

CIS Google Workspace Benchmark
Configuration guidelines to restrict external sharing and sender warnings

 

[Halp2001]

Even though Firebase is for developers, what we end up getting are emails with links that look like they’re from Google. Watch out: if the link doesn’t match the official site, better not click