Final Notice: Google Drive Share Phishing Delivering a GoTo Resolve Remote Access Agent

Since mid-September 2026, Vega Threat Research has tracked a phishing campaign delivering debt-collection lures through Google Drive sharing notifications. The operator creates disposable Google accounts, uploads debt-themed documents, and shares them with targeted recipients, who receive standard Google Drive notifications that pass sender-authentication checks. Across five observed waves, sharer display names impersonated at least twenty major law firms, while document titles used payment and account-restriction themes such as overdue balances and final reminders.

The notifications use several techniques that can complicate filtering and clustering. Document titles replace Latin letters with visually similar Cyrillic, Greek, Cherokee, and IPA characters, while randomized plus-tags are appended to recipient addresses so each notification carries a unique recipient string while still reaching the intended mailbox. Sharing accounts also use disposable Reply-To addresses on recently registered domains. One observed notification was sent to roughly two dozen unrelated recipients spanning consumer webmail, a university, a government organization, and several companies.

The shared document contains a button that redirects the victim to a blank page hosted in a randomly named Google Cloud Storage bucket. Within roughly one second, the browser contacts operator-controlled gate infrastructure. One observed gate server was identified as running the Keitaro traffic distribution system, while the remaining servers exhibited the same TDS behavior and are assessed with high confidence to also run Keitaro. Automated or unwanted visitors are frequently redirected to legitimate Yahoo or Google pages, while selected visitors receive a small VBScript saved to the Downloads folder under an e-signature-themed filename.

The VBScript requests administrative privileges, retrieves the location of the next-stage package from a second Google Cloud Storage object, and silently installs an MSI from the user's temporary directory. Subsequent network activity was consistent with the MSI installing a GoTo Resolve agent, giving the operator persistent interactive access through a legitimate, signed remote-management product.

The infrastructure follows a repeatable registration pattern. Reply-To domains were registered in bulk, often within seconds of one another and frequently before related phishing activity appeared in mailboxes, with domains from the same registration cluster sharing Cloudflare nameserver pairs. Gate domains used dyna-ns.net nameservers and resolved directly to dedicated servers without Cloudflare proxying.