Hackers Abuse Google Services as Trust Proxy to Steal Credentials and Deploy ScreenConnect

Threat actors are abusing trusted Google services to route phishing victims through legitimate-looking links before sending them to credential-harvesting pages or installing ScreenConnect remote-access software. According to a KnowBe4 Threat Lab analysis, the active campaign uses Google infrastructure as a trust proxy. Instead of placing an obvious malicious link in an email, attackers direct recipients through Google Meet, Google Search, DoubleClick, Custom Search, Image…

Diamond Model