8 minmedium
Click to Sync: From Google Ads Maintenance Notice to Credential Theft
A credential phishing campaign impersonates Google Ads MMC Sync maintenance notifications to trick users into synchronizing their accounts. The attack chain uses a spoofed sender domain, a blogspot redirect page, and a lookalike domain (mcc-sync-ads.com) hosting a Browser-in-the-Browser phishing page that simulates a legitimate Google sign-in popup to harvest credentials. The campaign leverages brand impersonation, false urgency, and multi-stage redirects to build trust and evade detection.
Sens:▲ 24hConf:medium
Showing defanged values
- domainenavalenceart[.]comSpoofed sender domain used in phishing email impersonating Google Ads MMC Sync notifications
- domainmcc-sync-ads[.]comNewly registered lookalike domain hosting the credential harvesting phishing page that mimics Google Ads login
- domainrenavalenceart[.]comSender domain observed in email metadata (image source); may be variant or typo of enavalenceart.com
- domainsyncmcchub[.]blogspot[.]comBlogspot subdomain abused as redirect intermediary in the phishing chain
- urlhxxps://syncmcchub[.]blogspot[.]com/2026/06/syncmcchub[.]htmlIntermediate redirect page hosted on blogspot that displays Google Ads branding and loading indicator before redirecting to the credential harvesting site
Detection / Hunteropenrouter
What Happened
Cybercriminals are sending fake emails that look like Google Ads maintenance notices, telling users they need to sync their accounts urgently or face service interruptions. When users click the link in the email, they are redirected through a series of fake web pages that look like Google, eventually arriving at a convincing but fake Google login page. This fake login page is designed to steal usernames and passwords. Anyone who uses Google Ads or Google Workspace could be targeted by this type of attack. It matters because stolen credentials can give attackers access to business accounts, advertising budgets, and potentially connected services. Organizations should train employees to verify unexpected account notifications through official channels and to be cautious of urgent requests to sync or update accounts via email links.
Key Takeaways
- Multi-stage phishing campaign impersonates Google Ads MMC Sync maintenance notifications to harvest credentials
- Attackers use a chain of redirects: phishing email to blogspot redirect page to lookalike domain mcc-sync-ads.com hosting a fake Google sign-in form
- Browser-in-the-Browser (BitB) phishing technique is employed to simulate a legitimate Google OAuth login popup within the phishing page
- Sender domain enavalenceart.com (also observed as renavalenceart.com) is used to spoof Google Ads branding and create false urgency
- Newly registered lookalike domains combined with trusted brand impersonation are used to evade traditional email security defenses
Affected Systems
- Google Ads account users
- Organizations using Google Workspace or Google Ads platforms
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing email sent from enavalenceart.com impersonating Google Ads MMC Sync with subject 'Quick action needed for your MCC account configuration'
- Redirection: User clicks 'Complete Sync Account' button and is redirected to syncmcchub.blogspot.com which displays Google branding and a loading indicator
- Credential Harvesting: User is redirected to mcc-sync-ads.com which hosts a phishing page mimicking Google Ads with a fake Google sign-in button
- Credential Capture: Clicking the sign-in button displays a JavaScript-based fake Google login form (Browser-in-the-Browser technique) that captures user credentials
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the article. The article is a descriptive analysis of a phishing campaign with IOC indicators only.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | This is a credential phishing campaign that primarily operates through email and web browser interactions. EDR would have limited visibility unless the phishing page deploys additional payloads or the user enters credentials in a non-browser context. |
| Network Visibility | Medium | Network monitoring could detect connections to the lookalike domains (mcc-sync-ads.com, syncmcchub.blogspot.com) and the spoofed sender domain (enavalenceart.com). DNS resolution and HTTP/S traffic to these domains would be visible at the network layer. |
| Detection Difficulty | Moderate | The phishing chain uses legitimate platforms (blogspot) as intermediaries and lookalike domains that may not be immediately flagged. However, the newly registered domains and the multi-stage redirect pattern provide detectable signals for email security and web filtering solutions. |
Required Log Sources
- Email gateway logs (sender domain, subject line analysis)
- Web proxy logs (URL access, domain reputation)
- DNS resolution logs
- Secure web gateway / URL filtering logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for emails with subject lines containing 'MCC account' or 'sync' combined with sender domains that are not Google-owned, as these may indicate similar phishing campaigns impersonating Google Ads. | Email gateway logs, mail flow logs with sender domain and subject line fields | Initial Access | Medium - legitimate Google Ads notifications may use similar language, but sender domain verification should differentiate |
| If you have web proxy or DNS logging, consider hunting for accesses to blogspot subdomains that redirect to newly registered domains containing 'ads', 'sync', or 'mcc' in their names, as this redirect pattern is characteristic of multi-stage phishing infrastructure. | Web proxy logs, DNS resolution logs, secure web gateway logs | Redirection | Low to Medium - legitimate blogspot pages exist, but the redirect-to-newly-registered-domain pattern is suspicious |
| Consider hunting for browser sessions where users interacted with JavaScript-based login forms rendered within a parent page on a non-Google domain, as this may indicate Browser-in-the-Browser phishing activity. | Web proxy logs, browser security event logs, EDR browser extension telemetry if available | Credential Harvesting | Low - legitimate OAuth flows typically redirect to accounts.google.com, not render within an iframe on a third-party domain |
Control Gaps
- Email authentication (SPF/DKIM/DMARC) may not prevent display name spoofing where the sender name shows 'Google Ads MMC Sync' but the domain is non-Google
- URL filtering may not catch newly registered domains before reputation databases are updated
- Legitimate platforms like blogspot being used as redirect intermediaries may bypass domain reputation checks
- Browser-in-the-Browser phishing techniques can bypass visual inspection by rendering fake browser chrome within the page
Key Behavioral Indicators
- Email sender display name 'Google Ads MMC Sync' with non-Google sender domain
- Email subject containing 'MCC account configuration' or 'sync' with urgency language
- Multi-stage redirect chain from email link to blogspot to newly registered lookalike domain
- JavaScript-based login form rendered within a parent page on a non-Google domain (BitB phishing indicator)
- Newly registered domains containing Google-related keywords (ads, sync, mcc) that are not owned by Google
False Positive Assessment
Medium - The phishing campaign uses Google Ads branding and language that closely mimics legitimate Google communications. Organizations that regularly use Google Ads may have legitimate sync-related emails, making it important to verify sender domains and redirect destinations before blocking.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified phishing domains (mcc-sync-ads.com, enavalenceart.com, renavalenceart.com) and the blogspot redirect URL at your email gateway and web proxy if supported by your tooling.
- Consider searching email gateway logs for the subject line 'Quick action needed for your MCC account configuration' and sender domains enavalenceart.com or renavalenceart.com to identify potential recipients who may have received the phishing email.
- If your email security platform supports it, consider adding the sender domains and phishing URLs to blocklists and alert on any future messages from these indicators.
Infrastructure Hardening
- Evaluate whether your email security solution can detect display name spoofing where the sender name references Google or other trusted brands but the sender domain does not match.
- Consider implementing or tuning URL rewriting and time-of-click protection to intercept redirect chains through legitimate platforms like blogspot.
- If applicable, evaluate whether your DNS filtering or secure web gateway can flag newly registered domains containing brand-related keywords (e.g., 'ads', 'sync', 'mcc') for additional scrutiny.
User Protection
- Consider deploying browser-based protections that detect Browser-in-the-Browser phishing techniques, if supported by your endpoint security tooling.
- Encourage users to verify any Google account synchronization or maintenance requests by navigating directly to ads.google.com rather than clicking links in emails.
- If your organization uses Google Workspace, consider enabling phishing-resistant MFA (such as security keys) for Google Ads and other sensitive accounts to reduce credential theft impact.
Security Awareness
- Consider incorporating this campaign into existing phishing awareness training as an example of multi-stage credential phishing using brand impersonation and false urgency.
- Remind employees that legitimate platform maintenance notifications typically do not require immediate account synchronization via email links and will not threaten service interruption for non-compliance within short timeframes.
- Encourage employees to report suspicious emails impersonating Google Ads or other business-critical platforms to the security team, even if the email appears legitimate at first glance.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping3 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic
Command and Control
Additional IOCs
- Other:
Quick action needed for your MCC account configuration- Email subject line used in the phishing campaign to create urgency
