Hackers Exploit Free Firebase Accounts to Launch Phishing Campaigns

The report describes a phishing campaign that abuses free Google Firebase developer accounts to send convincing fraudulent emails from firebaseapp.com subdomains which often bypass email security gateways. Attackers use scare tactics (account compromise alerts) and fake giveaways to lure victims into clicking links that redirect to external phishing pages (examples include clouud.thebatata.org and rebrand.ly), with guidance to monitor and block unknown Firebase subdomains and carefully verify sender addresses.