HookedWing: the phishing campaign impersonating Google, Microsoft, and GitHub

In May 2026, threat researchers identified and named a structured phishing operation called HookedWing, and what sets it apart from previous campaigns is not only the visual sophistication of the fake pages, but the surgical precision with which it targets the tools small and medium-sized businesses use every day: Google Workspace, Microsoft 365, and GitHub.

This is not about emails with poor language or pixelated logos. The login pages cloned by HookedWing faithfully reproduce the original authentication flows, including intermediate redirects, loading animations, and even contextual error messages that mimic the platforms' real behavior. The objective is twofold: to collect credentials and, in many cases, to hijack active session tokens using adversary-in-the-middle (AiTM) techniques, making SMS or TOTP-based MFA insufficient as a barrier.

How HookedWing operates in practice

The attack chain almost always begins via email or a direct message on collaboration platforms such as Slack or Teams. The pretext varies, a fake Google security alert, a notification of a pull request on GitHub, an expiration notice for a Microsoft 365 license. The embedded link points to a domain registered hours before the launch, often using subtle typographic variations (ex.: microsoft-sécurity[.]com, githüb[.]io) that go unnoticed during quick reads on mobile.

When clicked, the victim is led through a chain of redirects that bypass URL reputation filters, legitimate services such as Google Redirects or trusted shorteners are used as intermediate trampolines. The reverse proxy configured by the HookedWing operators then captures both the entered credentials and the session cookies issued by the legitimate provider, giving the attacker immediate access to the account, even if the victim has enabled authenticator app based two-factor authentication.

Why conventional MFA is not sufficient here

This is the point that troubles security teams at midsize companies the most, the perception that "enabling 2FA" resolves the problem. In the AiTM model used by HookedWing, the proxy does not need to break the second factor, it simply relays it in real time to the legitimate service and captures the resulting session cookie. The practical outcome is that accounts protected with TOTP (Google Authenticator, Authy) or SMS are as vulnerable as accounts without any additional factor.

The only category of MFA that resists this vector is FIDO2/WebAuthn-based authentication, physical security keys (YubiKey, Google Titan), or passkeys tied to the device. In these cases, the cryptographic key is bound to the legitimate domain during registration, and when the proxy attempts to replicate the flow on a different domain, the authentication simply fails without the victim needing to identify anything suspicious.

What changes for Brazilian SMBs

The small and medium-sized business market in Brazil has a characteristic that makes it a preferred target for campaigns like HookedWing, very high adoption of Google Workspace and Microsoft 365 combined with uneven security maturity. Many companies enabled MFA under pressure from insurers or audits, but stopped at TOTP, which is insufficient against AiTM.

There are three concrete operational changes every organization should implement now:

1. Migrar contas críticas para FIDO2/WebAuthn. Start with profiles that have access to sensitive data, code repositories, and cloud consoles. Google Workspace Enterprise and Microsoft Entra ID natively support policies that require FIDO2 keys for specific groups, without the need for additional tooling.

2. Implementar simulações de phishing com foco em discrepâncias sutis de URL. Tools such as KnowBe4 or Proofpoint Security Awareness Training allow creation of campaigns that test exactly the HookedWing pattern, domains visually close to the original and security alert pretexts. Internal FM Solutions client data shows that click rates in simulations drop 60% after two cycles of training focused on this specific pattern.

3. Habilitar alertas de login em localização/dispositivo incomum. Both Google Workspace and Microsoft 365 offer conditional access policies that block or flag sessions opened from unrecognized IPs or ASNs. For GitHub repositories, enabling audit logs and alerts via GitHub Advanced Security is the functional equivalent.

The silent risk: absence of malware alerts

An operationally critical detail of HookedWing is that it does not install any file on the victim endpoint. There is no executable, no malicious macro, no suspicious process running in memory. Conventional EDR and antivirus tools simply have nothing to detect. The compromise occurs entirely in the browser, via a hijacked legitimate session. This means the detection vector needs to be shifted to the identity plane, login anomalies, long-lived session tokens appearing in unexpected locations, and access to resources outside the user's historical pattern.

What to do in the next 48 hours

If your company has not yet audited which Google, Microsoft, and GitHub accounts are protected only with TOTP or SMS, that is the starting point. HookedWing is not a future threat, it is active now, and the cost of a compromised GitHub administrator credential can range from source code exfiltration to supply chain attacks against downstream customers.

The good news is that the most effective control, FIDO2, is available at no extra cost on the platforms your company already pays for. What is missing, in most cases, is the decision to implement it.