Full Report
Cómo GTFire abusa de Google Firebase y Google Translate para escalar campañas globales de phishing
Analysis Summary
# Tool/Technique: GTFire (Phishing Framework)
## Overview
GTFire is a sophisticated phishing framework and campaign methodology that leverages legitimate Google services—specifically **Google Firebase** and **Google Translate**—to host and obfuscate credential harvesting pages. By abusing these trusted infrastructures, the attackers bypass traditional email filters and security scanners, creating a highly scalable and convincing environment for global phishing operations.
## Technical Details
- **Type:** Phishing Framework / Campaign Methodology
- **Platform:** Web-based (Cross-platform; targeting corporate and personal web credentials)
- **Capabilities:** Credential harvesting, evasion of automated scanners, regional targeting, and automated redirection to legitimate websites.
- **First Seen:** Active through 2024 (Group-IB report date)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0005 - Defense Evasion]**
- [T1027.007 - Obfuscation: Stripped Payloads]
- [T1564 - Hide Artifacts (Abuse of Google Translate layers)]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle (Proxying login attempts)]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel (Via Telegram/PHP scripts)]
## Functionality
### Core Capabilities
- **Legitimate Infrastructure Abuse:** Uses `*.web.app` (Firebase) domains to host malicious landing pages, inheriting the reputation of Google's domains to evade blocklists.
- **Google Translate Wrapper:** Wraps phishing URLs inside a Google Translate frame. This adds a layer of "legitimate" obfuscation, making the URL appear as a translation request rather than a direct link to a phishing site.
- **Credential Harvesting:** Captures usernames, passwords, and potentially MFA tokens through custom scripts.
- **Dynamic Content Loading:** Tailors the phishing page to the victim's email domain to increase the appearance of legitimacy.
### Advanced Features
- **Anti-Analysis/Evasion:** The use of Google Translate serves as a "buffer" that often trips up automated sandboxes and link scanners that cannot effectively parse the nested redirection.
- **Post-Phish Redirection:** Once credentials are stolen, the script automatically redirects the victim to the actual login page of the spoofed brand. This delays detection, as users often assume a simple glitch occurred.
- **Regional Scalability:** The campaign is observed across over 100 countries, using localized templates.
## Indicators of Compromise
- **File Names:**
- `All-in-1.php` (Commonly used backend collection script)
- **Network Indicators:**
- `jnhwzs[.]fyi`
- `gnpnia[.]lat`
- Pattern: `translate.google.com/website?sl=...&u=https://[unique-id].web.app`
- Subdomains ending in `*.web.app`
- **Behavioral Indicators:**
- Traffic originating from legitimate Google Translate nodes but terminating at suspicious Firebase subdomains.
- Presence of Telegram API calls within web source code for data exfiltration.
## Associated Threat Actors
- **Unknown/General Cybercrime:** The framework is utilized by multiple actors globally, suggesting it may be sold as a Phishing-as-a-Service (PhaaS) or widely shared within the cybercrime community.
## Detection Methods
- **Signature-based detection:** Monitoring for the specific PHP script name `All-in-1.php` and the unique HTML structure of GTFire landing pages.
- **Behavioral detection:** Identifying nested URLs where a Google Translate link contains a secondary redirect to a Firebase `web.app` domain.
- **Email Gateway Rules:** Flagging emails containing Google Translate links that point to non-corporate or non-standard external domains.
## Mitigation Strategies
- **Prevention measures:** Implement FIDO2-compliant hardware keys (U2F) to prevent credential replay attacks.
- **Hardening recommendations:**
- Configure Email Security Gateways to strip or inspect nested URLs within Google Translate links.
- Implement strict DMARC/SPF/DKIM policies.
- Educate users on the "Translate wrapper" tactic, noting that legitimate logins will never occur through a `translate.google.com` frame.
## Related Tools/Techniques
- **Phishlets:** Used in Evilginx2/3 for session hijacking (similar in proxy behavior).
- **Typosquatting:** Often used in conjunction with the initial delivery phase.
- **Firebase Phishing:** Broader trend of using Google Cloud Platform (GCP) for hosting malicious assets.