# Fake Google Meet Login Pages (meet-google.cyou, qooglo.com) Harvesting Google Credentials and 2FA Codes

> Two malicious websites, meet-google.cyou and qooglo.com, host counterfeit Google Meet pages that solicit Google account passwords and 2FA codes. An exposed /install page on the phishing infrastructure reveals database configuration details and a prefilled database password.

- **Published:** 2026-10-20T08:01:30Z
- **Last reviewed:** 2026-10-20T08:01:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3941
- **ID:** TL-2026-3941
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Researcher Anurag (@Malwarehunterr) identified two domains, meet-google.cyou and qooglo.com, serving fake Google Meet pages designed to steal Google credentials and facilitate 2FA phishing. Victims are socially engineered into entering their Google account password on a lookalike sign-in page and then supplying a second-factor code, which gives the operator what is needed to attempt account takeover. The finding was reported on 2026-10-19 and published by Cyber Security News on 2026-10-20.

The reporting lists several web paths and API endpoints associated with the phishing infrastructure: /meet, /install, /assets/js/demo.js, /api/demo/sessions, /api/demo/sessions/{token} and /api/demo/sessions/{token}/resend. The session-token pattern and the 'resend' endpoint are consistent with a server-side session object that tracks each victim and re-prompts for a code, but the source does not document the backend logic, so this is an inference from the endpoint names only. The source does not say which paths are served on which domain.

The operator left an /install page exposed. Per the report, it reveals database configuration and a prefilled database password. The password value was not disclosed in the reporting and is not recorded here. The exposure indicates a deployable phishing kit or panel whose installer was left reachable, which may let a researcher or hosting provider identify the backend, but it is also a sign of low operator sophistication.

The source gives no CVE, CVSS score, actor attribution, malware family, delivery vector (email, messaging or ad) or victim counts. Severity MEDIUM is an analyst judgment. Impact on a compromised account depends on the victim's settings and connected services and may include documents, contacts, saved information and business data. A BeaconBeagle domain lookup for qooglo.com returned no C2 configuration matches. Only a single source was verified for the campaign itself.

## MITRE ATT&CK

- T1583.001 Domains
- T1598.003 Spearphishing Link
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1056.003 Web Portal Capture

## Sources

- [Hackers Using Fake Google Meet Pages to Steal Google Credentials](https://cybersecuritynews.com/fake-google-meet-pages/)
- [Related: Google AitM phishing kit (UAT-11985), Cyber Security News](https://cybersecuritynews.com/google-aitm-phishing-kit/)
- [Related: Threat actors using fake Google Forms site, Cyber Security News](https://cybersecuritynews.com/threat-actors-using-fake-google-forms-site/)
- [Related: Deceptive Google Meet Invites Lure Users Into Malware Scams, eSecurity Planet](https://www.esecurityplanet.com/trends/google-meet-invites-lure-users-into-malware-scam/)
- [Related: Join Google Meet Scam Email, MalwareTips](https://malwaretips.com/blogs/join-google-meet-scam-email/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3941