Phishing Attack Uses Fake Google Meet Pages to Steal Google Credentials

Key Takeaways

• Cybercriminals are leveraging two domains hosting convincing fake Google Meet pages to steal Google account credentials and bypass two-factor authentication (2FA).
• A critical misconfiguration on one of the phishing sites exposed an /install page, revealing database configuration details and a prefilled database password.
• The attack highlights the ongoing threat of sophisticated phishing campaigns that mimic trusted services to trick users into divulging sensitive information.
• Users are advised to scrutinize URLs carefully, use strong authentication methods like security keys, and regularly review account security settings.

New threat intelligence, released on October 20, 2026, reveals an active phishing campaign utilizing meticulously crafted fake Google Meet pages to compromise Google account credentials and circumvent two-factor authentication. This sophisticated operation leverages two distinct websites designed to appear as legitimate Google Meet interfaces, thereby increasing the likelihood of successful credential theft.

Beyond the deceptive login pages, a significant security flaw was uncovered on an exposed /install page associated with one of the malicious sites. This misconfiguration openly displayed sensitive database configuration information, including a prefilled database password. While the specific password itself was not disclosed in the report, this exposure represents a severe vulnerability that could provide attackers with deeper access to the phishing infrastructure. Analysts emphasize that the threat extends beyond merely capturing login details, as successful credential theft, particularly when combined with 2FA bypass, can grant attackers extensive access to a victim’s digital life.

The report currently lacks comprehensive details regarding the exact design of the phishing pages, the distribution methods used to lure victims, or any confirmed instances of account compromise. However, the identified tactics underscore the persistent challenge of combating evolving phishing techniques.

Anurag (@Malwarehunterr) identified and documented this campaign, providing crucial details about the two malicious domains, the exposed installation page, and the associated web paths in a post on October 19, 2026. Further technical details are available in the full report.

Deceptive Google Meet Pages Target User Credentials

The attackers exploit the widespread use of Google Meet for professional and personal communications, making a fake meeting invitation or login page appear highly credible. The identified domains, meet-google[.]cyou and qooglo[.]com, bear a striking resemblance to legitimate Google services, mimicking the official meet.google.com domain. This similarity is a classic phishing tactic designed to bypass casual scrutiny.

Users are urged to exercise extreme caution and meticulously verify the full URL of any website before entering login credentials, even if the page displays familiar branding or meeting-related terminology. The presence of an HTTPS connection or a padlock icon only confirms encrypted communication with the phishing site, not its legitimacy.

The reported phishing pages are engineered to steal Google account credentials and facilitate two-factor authentication (2FA) bypass. While the precise mechanics of the 2FA phishing were not detailed, the general risk involves capturing both the password and a one-time verification code. If attackers manage to obtain a password, the account is immediately vulnerable. If they also capture a 2FA code, they can often use it in real-time to gain unauthorized access before the code expires.

Google has consistently advised users to adopt stronger authentication methods, such as security keys or Google prompts, which are more resilient to phishing attacks. Furthermore, passkeys are specifically designed to offer enhanced protection against such threats.

Google Meet Phishing

Two domains hosting fake Google Meet pages designed to steal Google credentials and facilitate 2FA phishing.

Misconfiguration: An exposed /install page reveals database configuration and a prefilled DB password!

IOCs:

meet-google[.]cyou
qooglo[.]com… pic.twitter.com/u50nHZ2zME

— Anurag (@Malwarehunterr) October 19, 2026

A compromised Google account can expose more than just email. Depending on a user’s settings and integrated services, attackers could gain access to sensitive documents, contact lists, saved personal information, and even critical business data. Google recommends that users suspecting unauthorized access should immediately review their recent security events and connected devices. For additional context on how attackers target Google sign-ins and authentication, a previous report on a Google account phishing kit is available.

Exposed Installation Page Raises Separate Concerns

The discovery of a publicly accessible /install page on one of the phishing domains introduces a distinct security vulnerability. As highlighted in the threat intelligence, navigating to this path exposed sensitive database configuration details and a prefilled database password. This level of information leakage could significantly aid an attacker in understanding the backend architecture of the phishing site, potentially enabling further exploitation.

The report does not confirm whether these exposed details were actively used to access the database, nor does it provide the specific password value. However, the mere public exposure of such critical information is a serious security lapse. Legitimate web applications should never leave installation or setup routes publicly accessible, especially with sensitive credentials pre-filled or displayed. Operators of such sites should implement strict access controls, eliminate default or pre-filled secrets, and regularly audit for any exposed credentials. If such credentials are found to be valid, they must be immediately changed, and any systems utilizing them thoroughly inspected for compromise. The report does not indicate

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.