GTFire Phishing Campaign Exploits Google Services to Bypass Detection and Harvest Credentials

GTFire is a large-scale, global phishing campaign that abuses Google Translate and Firebase Hosting to mask and host credential-harvesting pages for many brands; telemetry links 120+ phishing domains and stolen credentials from over 1,000 organizations across 100+ countries, with automated collection on LiteSpeed PHP C2 servers. The report analyzes redirect chains, Base64-encoded URL parameters, subdomain generation patterns, and provides detection and mitigation guidance for defenders.