Full Report
How GTFire abuses Google Firebase and Google Translate to scale global phishing campaigns
Analysis Summary
# Tool/Technique: GTFire Phishing Scheme
## Overview
GTFire is a sophisticated phishing infrastructure and methodology that leverages legitimate cloud services—specifically **Google Firebase** and **Google Translate**—to bypass email security filters and scale global credential theft campaigns. The primary purpose is to host phishing content on trusted domains to increase deliverability and evade automated detection systems.
## Technical Details
- **Type**: Phishing Technique / Attack Framework
- **Platform**: Web-based (Targeting enterprise users globally)
- **Capabilities**: Automated credential harvesting, evasion of Secure Email Gateways (SEGs), legitimate service abuse, and victim redirection.
- **First Seen**: Active campaign identified in 2024 (Global scale).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0005 - Defense Evasion]**
- [T1564 - Hide Artifacts]
- [T1027 - Obfuscated Files or Information]
- [T1553.004 - Subvert Trust Controls: Install Root Certificate (Abuse of trusted Google domains)]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
## Functionality
### Core Capabilities
- **Google Firebase Hosting**: Uses `*.web.app` and `*.firebaseapp.com` subdomains to host phishing landing pages, benefiting from the high reputation of Google’s infrastructure.
- **Google Translate Abuse**: Encapsulates malicious URLs within Google Translate links (e.g., `translate.google.com/translate?sl=...&u=[malicious-url]`). This masks the final destination and often bypasses URL scanners that whitelist Google domains.
- **Credential Harvesting**: Employs scripts to capture usernames and passwords, specifically targeting corporate email accounts.
### Advanced Features
- **Evasion via Redirection**: After credentials are stolen, the script redirects the victim to the legitimate brand website. This "loops" the user back to safety, making them believe the first login attempt was a simple technical glitch.
- **Mass Localization**: By abusing Google Translate, the attackers can dynamically present the phishing page in the victim's native language, increasing the conversion rate of the scam.
## Indicators of Compromise
- **Network Indicators**:
- `jnhwzs[.]fyi`
- `gnpnia[.]lat`
- Pattern: `translate.google.com/translate?*u=*.web.app`
- Pattern: `*.firebaseapp.com`
- **File Names**:
- `All-in-1.php` (Commonly used credential collection script)
- **Behavioral Indicators**:
- Outbound traffic to Google Translate URLs containing encoded or external subdomains in the parameters.
- Unexpected redirection from a Google-hosted page to a corporate login portal.
## Associated Threat Actors
- While specific named groups were not identified, the campaign is noted for targeting over 100 countries, with a significant concentration in **Latin American** companies and global enterprise sectors.
## Detection Methods
- **Signature-based detection**: Scan for known malicious PHP scripts like `All-in-1.php`.
- **Behavioral detection**:
- Monitor for unusual volumes of traffic to Google Translate where the translated URL (`u=` parameter) points to non-indexed or suspicious subdomains.
- Detect unauthorized use of Firebase hosting within the corporate environment.
- **URL Analysis**: Inspect the tail end of Google Translate URLs to extract and analyze the target destination before allowing user access.
## Mitigation Strategies
- **Prevention measures**:
- Implement **Multi-Factor Authentication (MFA)** (preferably FIDO2/Hardware keys) to render stolen credentials useless.
- Block or strictly monitor traffic to `*.web.app` and `*.firebaseapp.com` if they are not required for business operations.
- **Hardening recommendations**:
- Configure Email Security Solutions to "unwrap" or "sandbox" links hidden within translation services.
- Educate users to inspect the address bar even when a "Google" domain is visible.
## Related Tools/Techniques
- **Living off Trusted Sites (LoTS)**: A broader category of abusing reputable cloud providers (AWS, Azure, Google Cloud) for malware hosting.
- **URL Padding/Redirection**: Techniques similar to those used in "Open Redirect" vulnerabilities.