A clever new credential phishing campaign is masquerading as a routine missed voicemail notification to trick unsuspecting workers into handing over their Google account passwords.
Security researcher Anurag recently uncovered the campaign and shared details with Cyber Security News, revealing a deceptive scheme that uses urgency and fake audio alerts to quietly lure targets into a multi-step credential trap.
Instead of relying on suspicious email attachments that often trigger security filters, the attack arrives as a simple message declaring a “New Audio MSG.” Users who click the embedded “Play Audio” button aren’t directed to an audio file. Instead, the link routes them through a series of redirects designed to obscure the final destination.
The initial link routes through established cloud and email infrastructure, including SendGrid (sendgrid[.]net) and AWS click-tracking (rdnjfgli.r.ap-northeast-1.awstrack[.]me), to bypass basic reputation checks. During this process, a Base64-encoded version of the target’s email address is appended to the URL fragment and preserved through the redirect chain.
The victim is then bounced to a fake Google Workspace or Google Voice landing page hosted at coderkubes[.]com/workspace/googlev.html. In the final stage, the attack leverages a local Blob URL to generate a convincing Google Accounts sign-in interface in the victim’s browser, fetching the underlying phishing scripts directly from external servers controlled by the attackers (spy.mwork801[.]com).
By using the encoded email parameter, the malicious page automatically pre-populates the victim’s address, making the fake login page look uniquely legitimate.
The true perimeter risk
When an attacker captures a corporate Google login, they gain far more than access to an inbox. A compromised account hands intruders the keys to Google Drive documents, sensitive calendar schedules, contact lists, and single sign-on (SSO) reset options for connected enterprise applications.
Worse, stolen credentials transform trusted corporate accounts into launching pads. Attackers routinely use compromised internal email addresses to launch secondary phishing campaigns against colleagues, suppliers, and client networks, effectively weaponizing an organization’s own brand reputation against its partners.
Decoding the tactics: Why anti-phishing tools miss the mark
What makes this campaign notable isn’t just the fake voicemail lure, but its deliberate evasion architecture. By routing traffic through trusted cloud services like AWS and SendGrid, the campaign exploits a major blind spot in legacy security tools: misplaced domain trust.
Traditional email security gateways often assign a high trust score to messages containing links hosted on reputable cloud platforms. Cybercriminals exploit this by using these services as initial hops before pushing the user to malicious infrastructure. Furthermore, assembling the final sign-in page dynamically via a browser Blob URL isolates the malicious code execution locally, preventing static web filters from scanning the final page payload in real time.
How to defend against this phishing campaign
To mitigate the risk of account takeover, security teams and employees should implement key defensive practices:
- Conduct a reality check: Voicemail notifications should play audio files, not demand an account password. Any notification asking for a re-login prior to playback should be treated as suspicious.
- Inspect the address bar: Always check the browser address bar before entering credentials. A Blob URL or an untrusted domain name is an immediate red flag, regardless of how official the page branding appears.
- Correlate telemetry: Defensive teams should monitor email telemetry for unusual redirect patterns, cross-reference email link clicks with sudden login attempts, and block identified malicious domains at the DNS and web proxy layers.
- Bypass email links: Rather than clicking links in unexpected audio alerts, open the service directly in a new browser tab to check for real messages.
This campaign shows how attackers are making familiar phishing lures harder to dismiss at a glance by combining legitimate cloud services, layered redirects, and convincing sign-in pages.
For employees, the safest habit remains simple: treat unexpected login prompts with caution and access services directly rather than through email links. For security teams, the broader challenge is to look beyond domain reputation alone and watch for the full chain of behavior that can turn a routine-looking voicemail alert into an account takeover.
Also read: For more on how emerging technology is reshaping cyber defense, read how OpenAI is testing GPT-5.6 against real-world cybersecurity challenges