Known malicious kithighphishing

"Final Notice" Google Drive share phishing: Keitaro gates delivering a GoTo Resolve remote-access agent

family: final-notice-drive-goto-2026-10

Debt-collection phishing campaign, active since mid-September 2026, that abuses genuine Google Drive share notifications. From throwaway Google accounts the operator shares a fake demand letter from a well-known law firm, with look-alike Cyrillic, Greek or Cherokee letters in the title and sender name so that keyword filters miss it. The letter's button leads through Google's redirector to a blank page in a randomly named Google Cloud Storage bucket, which passes the visitor within about a second to a gate server running the Keitaro traffic distribution system. Automated visitors are sent on to Yahoo or Google; selected Windows visitors receive a VBScript named e-Sign-Key-Access-ID<digits>.vbs. The script asks for administrator rights, reads the location of an MSI installer from a second Cloud Storage object and silently installs a GoTo Resolve remote-support agent, which gives the operator interactive access to the computer. A match means a scan of a Cloud Storage page with the campaign's generated path, of a gate host, or of a page that contacted a gate server.

Anchors

SMQL queryrun

url:*storage.googleapis.com/*-*-*/*-*/*-*.html* OR ip:172.86.112.171 OR ip:104.194.141.55 OR ip:45.61.182.129 OR ip:104.194.155.73 OR ip:45.61.183.113 OR ip:167.88.175.99 OR domain:*.importantnotificationshub.com OR domain:*.noticesinformationandupdates.com OR domain:*.importantnotificationsandupdates.com OR domain:*.inforeviewupdate.com OR domain:*.importantupdatesandnotices.com OR domain:*.updatesandnoticessecure.com OR domain:*.updatesandnoticessecure.online OR domain:*.agentrontris.com OR domain:*.limpmnjert.com OR domain:*.primaryofferstage.com OR contacted_host:notices.importantnotificationshub.com OR contacted_host:documents.inforeviewupdate.com OR url:*-*-*.storage.googleapis.com/*-*/*-*.html*

Provenance

Added: 2026-10-13 15:52

Tracking terms only: no stage-one page has been captured, so there is no content rule yet, and the gates show a plain 404 page or a decoy to automated visitors. The terms are (1) the bucket path that the operator's generator produces, <adjective>-<noun>-<number>/<adjective>-<noun>/<adjective>-<noun>.html, in both the path and the virtual-host form of a Cloud Storage URL; (2) the six gate servers 172.86.112[.]171, 104.194.141[.]55, 45.61.182[.]129, 104.194.155[.]73, 45.61.183[.]113 and 167.88.175[.]99, each dedicated to one or two gate domains. They are rented servers that can be reassigned once the operator leaves, so check the date of a match; (3) the gate domains and their subdomains. Two of these domains are our own assessment and not in the published report. noticesinformationandupdates[.]com was registered in the same second as the live gate importantnotificationshub[.]com (2026-10-09), with the same registrar and name servers, and is not yet pointed at a server. updatesandnoticessecure[.]online was registered in the same second as the gates importantupdatesandnotices[.]com and updatesandnoticessecure[.]com (2026-09-26). The Reply-To mail domains are used only in email and are not listed here. As of 2026-10-13 every known bucket had been suspended by Google, and only the gate at 167.88.175[.]99 still answered.

References:

Sightings (1)

Host	Scan	Script	Match	When
notices.importantnotificationshub.com	e60c2792…	—	query	2026-10-13 15:56