ScanMalware.com
Known malicious kitcriticalphishing

Google Sites fake reCAPTCHA gate leading to Google sign-in phishing

family: gsites-fake-recaptcha-gate-2026-10
Short link:scanmalware.com/h/327

A Google Sites page embeds an Apps Script web app that shows a counterfeit "google.com / Performing security verification" reCAPTCHA check. No real CAPTCHA is loaded: after a fake "Verifying" spinner the page forwards the visitor, with a per-visit token, to a Google sign-in phishing page on the operator's own domain. Sighted at sites.google[.]com/view/revert-change, reached through a legacy goo.gl short link and twittertussle[.]com, forwarding to revert-app[.]com.

Anchors

Hunting ruleFakeRecaptcha_Redirect_Gate_Kit
SMQL queryrun
contacted_host:revert-app.com OR contacted_host:www.revert-app.com OR contacted_host:twittertussle.com

Provenance

Added: 2026-10-31 12:40
Matches the gate's own page structure (its class names and its redirect function) wherever it is served, and the operator's domains in the redirect chain. The phishing domain answers scanners with a redirect to google.com, so a sighting on it can show Google's home page.

Sightings (14)Atom feed

HostScanScriptMatchScanned
n-ffed2b725zjddnqsqc5r7uxztf4m4yu4mb3qo3y-0lu-script.googleusercontent.come9c5a865…https://n-ffed2b725zjddnqsqc5r7uxztf4m4yu4mb3qo3y-0lu-script.googleusercontent.com/userCodeAppPanel#frame=0.0.0rule2026-10-31 17:21
script.google.come9c5a865…https://script.google.com/macros/s/AKfycbxOqfpd_unwTa72SbCAHc_vgb6Lt7P8ao8cgzlR5f-Wk6vgR-PZLWuSiRvucO_P7NKx/exec#frame=0rule2026-10-31 17:21
twittertussle.come9c5a865…—query2026-10-31 17:21
script.google.come9c5a865…https://script.google.com/macros/s/AKfycbxOqfpd_unwTa72SbCAHc_vgb6Lt7P8ao8cgzlR5f-Wk6vgR-PZLWuSiRvucO_P7NKx/execrule2026-10-31 17:21
n-ffed2b725zjddnqsqc5r7uxztf4m4yu4mb3qo3y-0lu-script.googleusercontent.com40477cda…https://n-ffed2b725zjddnqsqc5r7uxztf4m4yu4mb3qo3y-0lu-script.googleusercontent.com/userCodeAppPanel#frame=0.0.0rule2026-10-31 12:57
script.google.com40477cda…https://script.google.com/macros/s/AKfycbxOqfpd_unwTa72SbCAHc_vgb6Lt7P8ao8cgzlR5f-Wk6vgR-PZLWuSiRvucO_P7NKx/exec#frame=0rule2026-10-31 12:57
goo.gl40477cda…—query2026-10-31 12:57
script.google.com40477cda…https://script.google.com/macros/s/AKfycbxOqfpd_unwTa72SbCAHc_vgb6Lt7P8ao8cgzlR5f-Wk6vgR-PZLWuSiRvucO_P7NKx/execrule2026-10-31 12:57
n-ffed2b725zjddnqsqc5r7uxztf4m4yu4mb3qo3y-0lu-script.googleusercontent.com52b2ad72…https://n-ffed2b725zjddnqsqc5r7uxztf4m4yu4mb3qo3y-0lu-script.googleusercontent.com/userCodeAppPanel#frame=0.0.0rule2026-10-31 12:34
script.google.com52b2ad72…https://script.google.com/macros/s/AKfycbxOqfpd_unwTa72SbCAHc_vgb6Lt7P8ao8cgzlR5f-Wk6vgR-PZLWuSiRvucO_P7NKx/exec#frame=0rule2026-10-31 12:34
revert-app.comf1bb71ec…—query2026-10-31 12:01
revert-app.com0700b580…—query2026-10-31 12:01
script.google.com4f62c036…https://script.google.com/macros/s/AKfycbxOqfpd_unwTa72SbCAHc_vgb6Lt7P8ao8cgzlR5f-Wk6vgR-PZLWuSiRvucO_P7NKx/exec#frame=0rule2026-10-31 11:32
goo.gl4f62c036…—query2026-10-31 11:32