The Firebase Link That Scanned Clean and Malicious at Once

The only link in the email pointed at Google. Not a lookalike, not a redirector wearing Google's name. A real firebaseapp[.]com subdomain, DKIM-signed by firebaseapp[.]com, delivered by Google's own outbound mail servers with SPF passing.

When the link scanner protecting a national insurance claims-adjusting firm pulled that URL apart, it returned a verdict of Clean, correctly. Then it extracted a second URL from inside the first, sitting in a query-string parameter, and returned Malicious.

One click, two verdicts, same scan. Nothing about the sender was forged, nothing about the infrastructure was suspicious. The whole attack lived in a parameter.

The Sign-In Machinery Was Genuine

The subject line read Sign in to get $50 welcome rewards Here, trailed by cash and gift emoji and a request timestamp. The sender was noreply@goodblg50pp-0j3a593u[.]firebaseapp[.]com, with no display name at all. First-time sender, aimed at a VP-level employee rather than a shared inbox.

Firebase offers passwordless email-link sign-in: an application triggers the flow, Google emails a one-time link at the /__/auth/action endpoint, and opening it verifies the address. The link carries mode=signIn plus an oobCode, the out-of-band single-use token. Every component was well-formed because none of it was counterfeit. An attacker stood up a Firebase project, pointed the flow at the target, and let Google send the message.

That is why the headers read the way they do. SPF passed from a Google outbound host, DKIM passed with header.d=firebaseapp[.]com, composite authentication passed. The only wobble was DMARC, which returned a permerror with no action taken. Under RFC 7489 a permerror means the evaluator could not process a usable policy, so nothing was enforced and the message travelled on with a spam confidence level of 6: elevated, nowhere near a block. No impersonated brand to catch, either: the attacker never claimed to be Google. Google sent the mail.

One Parameter Carried the Whole Attack

Firebase's sign-in link accepts a continueUrl parameter. It exists so an application can return the user to wherever they started once their address is verified, and the flow honours it by design. Here it was set to a page on storage[.]googleapis[.]com, in a bucket the attacker controlled, alongside a tenantId value, the fingerprint of a multi-tenant identity setup rather than a hobby project.

So the open redirect was not a bug anyone exploited. It was a documented feature pointed at hostile content, wrapped in a URL whose visible domain belongs to Google and whose signature is valid. The recipient's own address was appended to that target as a fragment, so the funnel knew who was arriving before anyone clicked.

This is where the split verdict matters. Our scanner extracted both URLs and scored them independently. The firebaseapp[.]com auth link came back Clean, the honest answer for genuine Google infrastructure. The storage[.]googleapis[.]com target of its own parameter came back Malicious. Any control that inspects the first hop, checks a reputation list, and stops there sees only the word Clean. The 2024 Verizon Data Breach Investigations Report puts the median time to click a phishing link at 21 seconds and to submit data at 28. There is no window in which a first-hop verdict gets a second look.

No Password Field, Just a Countdown Clock

The page waiting at the far end was not a login form. Nothing on it asked for a password.

It was a paid-app-testing rewards funnel, the gig-economy flavour of fraud: earn cash for trying out apps and playing games. A countdown timer ticked toward an expiry that does not exist. A live counter reported dwindling remaining slots. A Trustpilot-style badge advertised a 4.5 out of 5 rating the page never earned, beside a testimonial credited to a fabricated reviewer.

Read the harvest correctly, because response depends on it. This funnel collects personal information and qualified leads, not logins: contact details, then more sensitive identity or payment data across successive steps. The exposure is the data submitted, plus the target's promotion onto a validated list for the next, better-tailored attempt.

See Your Risk: Calculate how many threats your SEG is missing

Detection came from behaviour, not headers, because the headers were telling the truth. The Adaptive AI behind Themis weighed a first-time sender with no display name, a reward-and-urgency lure, a senior recipient, and a nested redirect target that disagreed with its own wrapper. It scored the message at 83 percent confidence against a VIP recipient, and the incident auto-resolved as phishing.

The Same Kit, A Different Lure

The affected-mailbox record showed this was not a one-off build. Some weeks later, near-identical messages using an arcade sign-in pretext hit a second, similarly named organization four times inside roughly three hours. Same mechanism, same parameter trick, different copy pasted into the lure.

That is a template, not a bespoke attack. A fresh Firebase project costs nothing, produces a brand-new signing subdomain, and grants free authenticated delivery from Google. The 2024 Microsoft Digital Defense Report describes exactly this industrialization of low-signal delivery through trusted cloud services. Blocking one bucket or one subdomain buys nothing, because the next is a few clicks away.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link: one link, generated by a genuine cloud service on the attacker's behalf.
• T1204.001 User Execution: Malicious Link: the redirect fires only when the recipient opens the sign-in link.
• T1598.003 Phishing for Information: Spearphishing Link: the appended recipient address turns a click into mailbox validation.

What This Case Should Change

Treat URL parameters as URLs. Any parameter holding a second address is a redirect and earns its own lookup and its own verdict, whatever the outer domain says. A Clean wrapper with a Malicious payload is not a contradiction to be averaged away, it is the finding.

Stop granting cloud-hosted paths inherited trust. Object-storage buckets and vendor sign-in endpoints are rented, not vouched for, and CISA phishing guidance is blunt that filtering must be paired with detection that reads context. The NIST definition of phishing turns on deception of the recipient, not provenance of the hop.

Practically, that means URL and payload analysis that unwraps parameters and follows the chain to its terminus, paired with behavioural scoring that reacts to a first-time sender aiming a reward lure at a senior mailbox. It also means feeding what one organization catches back to everyone else, the point of community-sourced reporting across 35,000+ security professionals in 17,000+ organizations. A new Firebase project has no history to check, but it does have a shape thousands of other inboxes already recognize.