GTFireThreat actor
GTFire is a threat actor that leverages Google Firebase for hosting phishing pages and Google Translate to disguise malicious URLs, effectively bypassing security filters. The campaign employs a multi-step redirect chain to obscure the final phishing destination and utilizes All-in-1 PHP phishing scripts for rapid deployment and credential harvesting.From MISP Galaxy
Last reported 23 days ago, by Group-IB4 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1056.001Keylogging
“The screenshot above demonstrates the Milk Dragon plugin’s keylogging capability, which streams victim input from the phishing page to the operators in real time.”
- T1684Social Engineering
“…weaponized with minimal effort, traditional URL-based detection is insufficient, and brand abuse remains one of the most effective social engineering vectors.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy“In previous Group-IB blogs (GTFire Phishing Scheme and Phoenix Rising), we covered attacks that start with a suspicious email or text message.”
-
Milk Dragon: Huge Discounts on Social Media? Think Twice Before You Buy“In previous Group-IB blogs (GTFire Phishing Scheme and Phoenix Rising), we covered attacks that start with a suspicious email or text message.”
-
Esquema de Phishing GTFire: Evitando la detección mediante servicios de Google“Esquema de Phishing GTFire: Evitando la detección mediante servicios de Google”
-
GTFire Phishing Scheme: Avoiding Detection Using Google Services“GTFire Phishing Scheme: Avoiding Detection Using Google Services”
Indicators in its reports
named in the reports above- socket[.]ioin 2 reports
- hxxps://gxvv3mrr1-xn--wtsyr9q6-xn----c1a2cj-xn----p1ai.translate[.]goog/mon9K20E/KvQkJ/Y6Ufj?WTJGc2JDNTJhWEowZFdGc09VQmlZVzV5ZFhKaGJDNWpiMjB1WjNRPTpCNEkzWA+&_x_tr_sch=http&_x_tr_sl=deBoGBII&_x_tr_tl=wFpmJDGbin 2 reports
- hxxps://it1lhz.web[.]app/host:-%20%20login.:4592?+&_x_tr_sl=pJeMrUFy&_x_tr_tl=pJeMrUFyin 2 reports
- it1lhz.web[.]appin 2 reports
- jnhwzs[.]fyiin 2 reports
- gnpnia[.]latin 2 reports
Copy these 6 indicators · defanged
Thanks — we review every report.