Topic starter
11/06/2026 10:53 pm
TL;DR: A malvertising campaign impersonating TradingView used conditional redirects and attacker-in-the-middle phishing to steal Google Workspace credentials and live sessions, while also bypassing email-based phishing controls and many static detections, according to Push Security. The pattern shows browser-based identity controls matter when search-delivered lures, session theft, and rapid infrastructure rotation converge.
Editorial analysis by NHI Mgmt Group, based on content published by Push Security: “Analysing a sophisticated Google malvertising attack impersonating TradingView”.
By the numbers:
- 4 in 5 ClickFix attacks intercepted by Push were delivered via Google Search.
Key questions
Q: What breaks when phishing moves from email into Google Search ads?
A: Email-only phishing controls lose their primary detection surface when the lure arrives through search advertising.
Q: Why do attacker-in-the-middle attacks increase Google Workspace account risk?
A: Because they can capture a live authenticated session after the victim has completed sign-in.
Q: What are the signs that a malvertising phishing chain is hiding from analysis?
A: A common sign is a page that looks harmless when loaded directly but changes behaviour only after the correct click path or parameters are supplied.
Practitioner guidance
- Harden browser-side phishing detection Use controls that inspect the full page load and login flow in the browser, not only mail gateways and static URL feeds.
- Review Google Workspace session-risk signals Correlate sign-in events, unusual browser sessions, and token reuse so live session theft is visible as a distinct compromise pattern.
- Block search-delivered lure paths Treat Google Search and other ad-delivered entry points as active phishing channels and apply monitoring to user navigation into login pages.
Bottom line: This campaign shows that phishing controls built around email are no longer enough when attackers use search ads, redirect chains, and browser-time credential theft.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 7:18 am
Browser-mediated identity is now the real phishing boundary: This campaign did not try to defeat Google Workspace at the mail layer, it tried to win inside the browser after search discovery. That shifts the governance problem from message inspection to session assurance, because the decisive control point is where the login interaction is completed. For identity programmes, the relevant question is whether browser-time telemetry is part of the access model, not whether email security is tuned harder.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: What should teams do when a stolen browser session is suspected?
A: Contain the session before the attacker can reuse it. Revoke or invalidate the token, review recent consent grants and browser activity, check for extension abuse, and examine whether the account was used to access administrative or data-heavy applications. The goal is to stop replay and identify what the session already touched.
👉 Read our full editorial: Malvertising AiTM phishing is bypassing Google Workspace defences