Hackers Leveraging Free Firebase Developer Accounts to Send Phishing Emails

Unit 42 observed a surge in phishing campaigns that abuse free Firebase developer accounts to host convincing brand login pages on firebaseapp.com and web.app subdomains. By leveraging the trusted reputation of Google-hosted domains, these pages often bypass email and URL security filters, increasing delivery and credential-theft success; the report highlights the attackers’ use of urgent lures, the ephemeral provisioning of new projects when flagged, and recommends strict URL inspection and user education as mitigations.