How Attackers Abuse Google and WhatsApp Links to Steal Logins

A new phishing attack abuses two names people trust: Google and WhatsApp. Instead of sending a suspicious link to a strange website, criminals host a form or redirect on a legitimate Google service and then deliver the link through a chat message that looks like an ordinary document share. Because the first domain is trusted, many filters and many people let it through.

Why trusted domains make phishing harder to spot

Mail and chat filters judge links by reputation. A page on a major Google service carries a strong reputation, so it rarely triggers a warning. The attacker only needs the final landing page to look convincing. Victims who have been trained to check the address bar see a familiar domain at the start and relax, not realising that the real destination is a few redirects away.

How the scam works step by step

The victim receives a WhatsApp message, often from a hijacked contact, saying that a file, invoice or photo album has been shared. The link opens a Google-hosted page that forwards to a fake sign-in screen. When the person enters a password and a one-time code, the page relays both to the real service within seconds, so the attacker signs in before the code expires. This real-time relay is why text-message codes fail against modern phishing kits.

What the attackers do with access

Once inside an account the criminals read mail for invoices and password resets, add forwarding rules to hide their activity, and message the victim contacts to spread the scam further. In a business setting they may impersonate staff to request payments. Because the account is real and the messages come from known people, follow-on attacks succeed far more often than cold emails.

Defences that actually work

Move staff to phishing-resistant sign-in such as passkeys or hardware security keys, which refuse to work on a fake domain. Teach people to open services by typing the address or using a saved bookmark, never from a shared link. Block or restrict personal messaging apps on managed laptops where policy allows, and enable alerts for new forwarding rules and sign-ins from unusual countries.

What to do if you clicked

Change the password from a clean device, sign out all sessions, review forwarding and recovery settings, and warn your contacts. Report the page to the provider so that it can be taken down. Tell your security team quickly so that they can search for the same lure in other mailboxes.

Spotting the scam before you click

Pause when a message creates urgency or arrives from a contact in an unusual way, such as a sudden file share with no explanation. Message the person through another channel to confirm they sent it.

Look at the final address after opening a link and be suspicious of any request to sign in again to view a document. Real file shares rarely require that. If in doubt, close the page and reach the service directly.

Frequently asked questions

Can a Google link ever be unsafe?

Yes. Anyone can create forms and pages on large platforms, so the domain proves only where the page is hosted, not who wrote it.

Do password managers help?

They do. A manager will not autofill a password on a look-alike domain, which is a strong warning sign.

Final thoughts

Trusted names are no longer a guarantee of safety. Use phishing-resistant sign-in, treat unexpected shared files with suspicion and report anything odd quickly. These habits stop this attack and many similar ones.