The GTFire Scheme: How Cybercriminals are Weaponizing Google’s Trusted Services for Global Phishing

The report details the GTFire credential-harvesting phishing campaign that hosts impersonation pages on Google Firebase and hides them via Google Translate links to evade detection; attackers capture credentials, automatically redirect victims to legitimate sites, and store harvested data in organized C2 backends, impacting thousands of accounts across 1,000+ organizations and 100+ countries.