Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A Google account phishing kit uses live WebSocket connections to guide victims through fake sign-in screens, relay authentication requests, and steal authenticated sessions.
Summary
The campaign shows how attackers can get past MFA by forwarding login steps in real time rather than breaking the security checks themselves.
This is a brief wire summary, the full story (linked below) has the complete details.
KazaSec's take
Phishing and credential-based attacks succeed because they target people, not just infrastructure, technical controls like SPF, DKIM, and DMARC only ever close part of that gap. The rest comes down to whether a team can actually spot the fake, and whether a compromised credential can still be reused anywhere else.
Coverage details
We've archived 156 other articles touching the same topic (cyber security, cyber security news, threats) , see the full security news archive.
Related security advisories
Relevant from KazaSec
More coverage on this topic
We help organizations find and fix the gaps before they make headlines.