2 Phishing Domains Mimic Google Meet to Steal 2FA Codes; Exposed DB Passwords Aid Attackers

Two websites are hosting deceptive pages that mimic the Google Meet interface to steal user credentials and bypass two-factor authentication protections, according to threat intelligence shared by Cyber Security News. The campaign involves domains that resemble legitimate Google services but are not affiliated with the company. These pages are designed to trick users into entering sensitive account information under the guise of joining a video meeting.

What environments are exposed to this threat?

The two domains involved in this campaign are meet-google.cyou and qooglo.com, according to the report by Cyber Security News. Neither domain is the genuine meet.google.com address, but their names use terms that resemble Google-related branding to create confusion. Users visiting these sites may not immediately recognize them as fraudulent because the pages imitate the familiar design and language of the real meeting service. This visual similarity makes the request for account details appear legitimate to unsuspecting visitors.

View the original post on X

How do these phishing pages operate?

The fake pages are designed to harvest Google account credentials and facilitate phishing attacks involving two-factor authentication codes, according to the researcher Anurag. When users enter their passwords or verification codes on these sites, criminals can potentially use those details to attempt unauthorized access to the accounts. The report does not specify whether the sites relay authentication in real time or simply store the stolen data for later use. The goal is to gain full control over the compromised accounts.

What additional security risks were discovered?

Beyond the phishing pages, the researcher reported a serious security issue on an exposed installation page within the same infrastructure, according to Cyber Security News. This page reveals database configuration information and includes a prefilled database password. While the source does not disclose the actual password value, the exposure of such configuration data highlights a risk that extends beyond simple credential theft. This misconfiguration could allow attackers to gain deeper access to the underlying systems hosting the phishing content.

What is the potential impact of a breach?

A successful compromise can put an entire Google account at risk, which may hold more than just email data, according to the report. Depending on user settings and connected services, attackers could access documents, contacts, saved information, or business data. Criminals can also use the compromised account to send believable messages to the victim’s contacts, further spreading the attack. Google advises users to review recent security events and devices if they suspect unauthorized access to their accounts.

Detection notes

Security operations teams should monitor for logins originating from unfamiliar IP addresses or geographic locations that do not match user behavior. Alert on authentication attempts that fail due to incorrect two-factor codes, as this may indicate an attacker trying captured codes. Check proxy logs and DNS queries for connections to domains with slight misspellings of known services, such as cyou or com variants of popular brands.

Investigate any exposed configuration files or installation pages on internal web servers immediately. Ensure that alerts trigger when sensitive data, like database credentials, appears in public-facing URLs. Review user-agent strings for anomalies that might indicate automated scraping or phishing tools. Contain suspected compromised accounts by forcing password resets and revoking active sessions.

Background: Phishing

You fall for phishing when you trust visual cues over technical indicators. Verify the domain in the address bar, check for HTTPS certificates, and disable auto-login features. These small habits stop attackers from stealing credentials or installing malware through deceptive links and attachments.

Read the full guide: 7 Phishing Mistakes That Bypass Your Defenses

What to do and how to stay safe: Google Meet

• Verify the full domain name in the browser address bar before entering any credentials, ensuring it matches the official service URL exactly.
• Use phishing-resistant verification methods such as security keys or passkeys, which are designed to prevent credential theft via fake pages.
• Monitor account activity logs for unrecognized devices or locations, and report any suspicious login attempts immediately.
• Avoid clicking on meeting links from untrusted sources; instead, navigate directly to the meeting service through a bookmarked or manually typed URL.

Step-by-step guide: Multi-Factor Authentication: Real Benefits and Hidden Failure Modes

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are these fake Google Meet sites currently active?

Yes, threat intelligence shared on October 20, 2026, identified two active domains hosting these phishing pages.

Did the researcher disclose the stolen database password?

No, the source does not disclose the actual password, though it confirms that a prefilled password was exposed on the installation page.

Can attackers use stolen 2FA codes from these sites?

Yes, analysts say criminals may use captured verification codes to try to access the account if the user entered them on the fake site.