Attackers Pivot to SEMrush Spoof to Steal Google Credentials

Researchers reported a phishing campaign targeting SEO professionals that uses malicious Google Ads to surface fake SEMrush pages; users who click the ads are taken to look-alike domains and prompted to enter Google credentials which are exfiltrated to attackers. Because many SEMrush accounts are linked to Google accounts and other services, attackers who capture credentials can hijack advertiser accounts and access sensitive company data, creating a cascading fraud cycle.