Researchers Detail Google Family Link Abuse in Account-Hijacking Campaign

May 20, 2026 · Original article ↗

Summary

Researchers describe a Discord-led malware campaign that allegedly hijacks Google accounts by abusing Family Link. Their tests found age changes could lack reauthentication, but supervision setup results varied; they offer account-security recommendations.

Key points

The reported campaign begins with Discord messages promoting a game review and links to fake game sites that deliver executables via Dropbox.
Researchers could not obtain the executable; the reported malware can steal credentials and hijack browser sessions, but its family and exact behavior remain unknown.
In a successful test using established accounts, researchers assigned a parent account without an MFA check. A separate dummy-account test instead required credit-card identity verification.
Researchers found that changing an account’s birthday to make it a child could proceed without reauthentication; completing supervision still required the child account’s password.
Once supervision is established, a parent can change the child account’s password, while recovery may require parental approval, potentially locking the legitimate user out.
The article describes a victim whose accounts were reportedly hijacked and whose attackers demanded $250 to withhold information, $250 to return accounts, or $450 for both.
Recommendations include enabling MFA, disabling Google’s “Skip password when possible” setting, treating unexpected downloads cautiously, and keeping account backups.

Article Details

Attack Vectors: Attackers reportedly used compromised Discord accounts to send game-review links to contacts.
The links led to fake game websites that directed victims to Dropbox-hosted malicious executables.
The executable was reported to steal login credentials and hijack browser sessions; researchers could not obtain a sample to identify its malware family.
Using compromised account access, attackers changed victims’ Google account ages to trigger Family Link supervision under a malicious parent account, enabling account lockout and ransom demands.
Defensive Notes: Treat unexpected links and downloads cautiously, including those sent from trusted or compromised accounts; verify URLs and scan files.
Run untrusted files in a protected environment such as a sandbox or virtual machine.
Enable multifactor authentication, preferably with a non-SMS option such as an authenticator app or hardware key.
Disable Google’s “Skip password when possible” setting and avoid storing Google passwords where malware could access them.
Maintain periodic Google Takeout backups to preserve recovery options.

Indicators of compromise

Type	Indicator	Context
URL	`hxxps[:]//dungeonwarriordemo[.]netlify[.]app`	Fake game-lure site identified as campaign infrastructure.
URL	`hxxps[:]//hyperionbeta[.]netlify[.]app`	Fake game-lure site analyzed by researchers and identified as malware-distribution infrastructure.
URL	`hxxps[:]//vampirk-beta[.]netlify[.]app`	Fake game-lure site identified as campaign infrastructure.
URL	`hxxps[:]//www[.]dropbox[.]com/scl/fi/hrbi8psg6j123os5lg56t/HyperionV2.exe`	Specific Dropbox URL identified as hosting a malicious executable delivered by the campaign.
URL	`hxxps[:]//www[.]dropbox[.]com/scl/fi/wduyccgsm5njhhpvqhhog/DungeonWarriorDemo.exe`	Specific Dropbox URL identified as hosting a malicious executable delivered by the campaign.