Scams & Phishing News Hackers Stream Real Google Login Pages to Steal Passwords and 2FA Codes

[Brownie2019]

Content source

https://hackread.com/hackers-google-login-pages-steal-passwords-2fa-codes/

NordVPN researchers found a phishing service relaying live Google sign-in sessions to intercept passwords, 2FA codes, and active authenticated account sessions.
Cybersecurity researchers from NordVPN have identified a phishing platform that uses a live Google login session to steal passwords and two-factor authentication codes from victims.

The campaign starts with an email designed to look like a Google Voice voicemail alert. The messages are sent from compromised legitimate accounts, which can help them pass standard email authentication checks.

NordVPN’s threat intelligence unit first identified executives/CEOs as the key targets, but the team later found that phishing emails were not limited to them and employees at other organizations were targeted as well.

Attackers Relay Real Google Login Pages

Read more: https://hackread.com/hackers-google-login-pages-steal-passwords-2fa-codes/

 

[Bot]

Read more: https://hackread.com/hackers-google-login-pages-steal-passwords-2fa-codes/

Hi, this is an adversary-in-the-middle phishing technique: the victim sees content relayed from Google, but interacts through an attacker-controlled site. That distinction matters because a genuine-looking login page—and even valid Google responses—does not make the address bar genuine.

How the theft works​

The relay passes the victim’s entries to Google and returns Google’s responses in real time. This can let the attacker capture:

• the password;
• a one-time 2FA code or approval;
• the authenticated session token created after successful login.

Stealing the session is the nasty part. It may allow account access without repeatedly supplying the password or 2FA code, at least until that session is revoked or expires. Two-factor authentication still helps against many attacks, but ordinary OTP codes and push approvals are not inherently resistant to a live relay.

The quoted report does not identify the exact relay software or establish the campaign’s present scale, so those details should not be inferred from the headline alone.

What users should check​

The reliable check is the site origin in the address bar, not how convincing the page looks. A padlock only means the connection to that particular site is encrypted; phishing sites can have HTTPS too.

Practical precautions:

1. Do not sign in through a voicemail-alert link. Open Google Voice or the relevant Google service directly from a bookmark or by typing its known address.
2. Treat an unexpected Google sign-in after clicking an email as a warning, even when the page looks flawless.
3. Prefer phishing-resistant authentication such as passkeys or FIDO2 security keys where available. These bind authentication to the legitimate site and are designed to defeat this sort of relay.
4. Do not trust an email merely because it passed SPF, DKIM or DMARC. A message sent through a compromised legitimate account can authenticate correctly and still be malicious.

If someone entered credentials​

From a separate trusted device, use Google’s official account page to:

• change the password and change it anywhere else it was reused;
• sign out or revoke other active sessions;
• remove unrecognized devices, third-party access and app passwords;
• verify recovery email addresses and phone numbers;
• inspect Gmail forwarding, filters and delegation settings;
• enable a passkey or security key where practical.

Changing the password alone should not be assumed to invalidate every stolen session. If this involved an organizational account, report it promptly to the security or IT team so they can review sign-ins and revoke sessions centrally.