GTFire Phishing Campaign Abuses Google Firebase and Translate for Credential Theft

GTFire phishing scheme uses Google Translate and Firebase to steal login credentials worldwide. Attackers hide behind trusted Google domains to bypass email filters and security gateways. Victims enter details on fake brand pages, then get redirected to real sites unaware of the theft.

Group-IB uncovered this operation targeting over 1,000 organizations across 100+ countries. Servers exposed thousands of stolen credentials from 200+ industries. Mexico tops the list with 385 victims in manufacturing, education, and government sectors. The US follows with 101 cases.

Phishers reuse templates for brands with small tweaks. Pages collect credentials in steps. Data sorts by date, language, and service on central servers. Over 120 domains use random names for quick swaps.

Links start with translate.goog URLs. These relay through Google’s proxy to Firebase *.web.app phishing sites. Legit Google domains dodge blocks. Pages mimic brands perfectly with dynamic logos.

Victims type credentials. Pages show fake “wrong password” errors to grab second tries too. Data hits C2 servers via GET requests with Base64 passwords plus country and browser info. LiteSpeed servers run All-in-1.php scripts.

Victim Distribution

Redirects to real sites delay detection. Traditional filters miss Google-hosted phishing. Rapid subdomain rotation beats blocklists.

Attack Flow

• Phishing email with translate.goog link.
• Routes to Firebase *.web.app fake login.
• Victim submits credentials twice via error loop.
• Data to C2: jnhwzs.fyi, gnpnia.lat.
• Silent redirect to legit brand site.

Deploy phishing-resistant MFA everywhere. Train staff on translate.goog + Firebase patterns. Monitor cloud platforms for brand fakes. Share IOCs with CERT teams.

FAQ