Threat actors are abusing multiple Google services to evade detection, ultimately harvesting credentials or installing ScreenConnect remote access.
Attackers Use Multi-Hop Google Redirects for Phishing Campaign
Summary + source link. No paywalls, no tracking.