Phishing Campaigns Abuse Trusted Platforms and Legitimate Workflows to Evade Detection

Multiple campaigns are abusing legitimate cloud and platform workflows to make phishing and fraud harder to detect. Attackers are generating real Apple and PayPal invoice/dispute emails and embedding scam phone numbers in user-controlled fields (e.g., “seller notes”), resulting in messages that carry valid DKIM signatures and originate from high-reputation domains; this “DKIM replay” style abuse bypasses many email controls because authentication validates the sender domain, not the safety of the embedded content. In parallel, threat actors are leveraging free Google Firebase developer accounts to host brand-mimicking phishing pages on trusted firebaseapp.com / web.app subdomains, increasing delivery and click-through rates by exploiting domain reputation and common allowlisting of Google infrastructure.

A separate but related social-engineering technique targets Telegram users by manipulating Telegram’s official authentication workflows to obtain fully authorized sessions rather than simply stealing passwords. Victims are lured to Telegram-lookalike pages (often on ephemeral domains) that prompt QR scanning or phone-number entry; user interaction triggers a real login attempt initiated by the attacker, and once the victim approves the authorization prompt on their device, the attacker gains persistent account access and can pivot to follow-on attacks via the victim’s contacts. These incidents collectively highlight a shift toward “living off trusted services,” where adversaries avoid compromising vendors and instead weaponize legitimate features, trusted domains, and sanctioned authentication flows to reduce detection and increase victim compliance.