Threat reportPhishingTL-2026-3941
Fake Google Meet Login Pages (meet-google.cyou, qooglo.com) Harvesting Google Credentials and 2FA Codes
Fake Google Meet Login Pages (meet-google.cyou, qooglo.com) (TL-2026-3941) is a medium-severity phishing campaign, first published 2026-10-20. It has no confirmed attribution, affects Google Google Account / Google Meet (impersonated brand), maps to 5 MITRE ATT&CK techniques (T1056.003, T1111, T1583.001), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3941
- Threat ID
- TL-2026-3941
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- general, enterprise
- Detection rules
- 9
- Indicators of compromise
- 11
How Fake Google Meet Login Pages (meet-google.cyou, qooglo.com) works
Two malicious websites, meet-google.cyou and qooglo.com, host counterfeit Google Meet pages that solicit Google account passwords and 2FA codes. An exposed /install page on the phishing infrastructure reveals database configuration details and a prefilled database password.
Researcher Anurag (@Malwarehunterr) identified two domains, meet-google.cyou and qooglo.com, serving fake Google Meet pages designed to steal Google credentials and facilitate 2FA phishing. Victims are socially engineered into entering their Google account password on a lookalike sign-in page and then supplying a second-factor code, which gives the operator what is needed to attempt account takeover. The finding was reported on 2026-10-19 and published by Cyber Security News on 2026-10-20.
The reporting lists several web paths and API endpoints associated with the phishing infrastructure: /meet, /install, /assets/js/demo.js, /api/demo/sessions, /api/demo/sessions/{token} and /api/demo/sessions/{token}/resend. The session-token pattern and the 'resend' endpoint are consistent with a server-side session object that tracks each victim and re-prompts for a code, but the source does not document the backend logic, so this is an inference from the endpoint names only. The source does not say which paths are served on which domain.
The operator left an /install page exposed. Per the report, it reveals database configuration and a prefilled database password. The password value was not disclosed in the reporting and is not recorded here. The exposure indicates a deployable phishing kit or panel whose installer was left reachable, which may let a researcher or hosting provider identify the backend, but it is also a sign of low operator sophistication.
The source gives no CVE, CVSS score, actor attribution, malware family, delivery vector (email, messaging or ad) or victim counts. Severity MEDIUM is an analyst judgment. Impact on a compromised account depends on the victim's settings and connected services and may include documents, contacts, saved information and business data. A BeaconBeagle domain lookup for qooglo.com returned no C2 configuration matches. Only a single source was verified for the campaign itself.
MITRE ATT&CK techniques used in TL-2026-3941
Credential Access
T1056.003 Web Portal Capture; T1111 Multi-Factor Authentication Interception
Resource Development
Reconnaissance
Defense Evasion
Affected products and versions in Fake Google Meet Login Pages (meet-google.cyou, qooglo.com)
- Google — Google Account / Google Meet (impersonated brand)
Remediation for Fake Google Meet Login Pages (meet-google.cyou, qooglo.com)
Immediate actions
- Block meet-google.cyou and qooglo.com at DNS, proxy and email gateways
- Search proxy, DNS and email logs for access to the listed domains and for requests to /api/demo/sessions and /assets/js/demo.js
- Reset passwords and revoke sessions for any account that entered credentials or 2FA codes on these domains
- Review Google account security events and sign-in logs for affected users
Workarounds
- Only join meetings through links on meet.google.com or from the Google Calendar entry
Longer-term hardening
- Enroll users in security keys or Google prompts instead of SMS/OTP-style 2FA codes
- Alert staff to the lookalike Google Meet domains and train users to verify the full URL before authenticating
- Monitor sign-in logs for anomalous logins following phishing exposure
Timeline of Fake Google Meet Login Pages (meet-google.cyou, qooglo.com)
- The phishing infrastructure is observed with an exposed /install page revealing database configuration and a prefilled database password.
- Researcher Anurag (@Malwarehunterr) identifies fake Google Meet pages on meet-google.cyou and qooglo.com that collect Google credentials and 2FA codes.
- Campaign retained by Threadlinqs as a low-confidence, IOC-driven phishing threat with no attribution, CVE or victim counts.
- Open-web search for both domains finds no independent reporting; the campaign remains single-source.
- BeaconBeagle config search for meet-google.cyou returns zero matches (items 0, total 0).
- BeaconBeagle domain lookup for qooglo.com returns no C2 configuration matches.
- Cyber Security News publishes the campaign, listing both domains and the /meet, /install, /assets/js/demo.js and /api/demo/sessions endpoints.
Sources cited for Fake Google Meet Login Pages (meet-google.cyou, qooglo.com)
- Hackers Using Fake Google Meet Pages to Steal Google Credentials
- Related: Google AitM phishing kit (UAT-11985), Cyber Security News
- Related: Threat actors using fake Google Forms site, Cyber Security News
- Related: Deceptive Google Meet Invites Lure Users Into Malware Scams, eSecurity Planet
- Related: Join Google Meet Scam Email, MalwareTips
Detection coverage for TL-2026-3941
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3941 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.