Your two-factor codes are not the safety net you think they are. A phishing kit that NordVPN’s Threat Intelligence team analyzed shows how an attacker can take over a Google account while the victim does everything “right”, including typing the 2FA code.
Note that this is a vendor’s own research, so treat the scale claims with some caution. The technical mechanics, though, are well understood and plausible.
How the lure works
It starts with an email that looks like a Google Voice voicemail notice. The attackers send it from previously compromised legitimate accounts, which helps it pass SPF, DKIM, and DMARC checks. Those checks only confirm the sender is approved for a domain. They say nothing about whether the sender is honest.
The link runs through SendGrid, a legitimate delivery service, then lands on a fake Google Voice page. The button only works if you arrive via that tracking link with the right campaign string. Some victims also see a prompt to enable browser push notifications, which gives the attacker a lasting channel to reach you even if you never log in.
Built to dodge scanners
Before showing the real trap, the platform demands a Cloudflare Turnstile check. That tool exists to filter bots. Here it filters out security researchers and sandboxes. NordVPN’s scripted attempts failed, so the team confirmed the final stage by browsing manually. A scanner may see a harmless page while you see the live attack.
The login is genuine, and that’s the problem
This is browser-in-the-middle phishing. The attacker’s server opens the real Google login and streams it to your screen. Every click and keystroke passes through the attacker first. Typos and bad logos won’t give it away, because there aren’t any.
Your password, your one-time code, and the resulting session cookies or tokens are all captured in real time. The code is used instantly, so app or SMS codes offer no protection. The platform can also capture recovery codes, which let attackers bypass later checks.
A human operator can watch sessions live and take control. The session tokens carry campaign identifiers, which points to phishing-as-a-service: one group builds the kit, others rent it.
Why workplaces should care
The campaign reportedly hit CEOs and senior executives first, then employees across whole organizations. That matters because a work Google account holds shared files, internal mail, calendar invites, and password reset links. One hijacked account can open the door to other tools, and an impersonated executive makes CEO fraud far easier.
What you can actually do
The only reliable clue is the address bar. The research identified onverinusinesscommunicationscente.org as the attacker’s domain, and the tab was titled “Secure browser session” instead of Google. If you get a voicemail email you didn’t expect, don’t click it. Check Google Voice directly by typing the address yourself.
The stronger fix is phishing-resistant login, meaning passkeys or hardware security keys. They are bound to the real domain, so they simply won’t work on a lookalike site. If your organization still relies on SMS or app codes, this research is a good reason to ask why.