TLDR Tech / InfoSec
Analysis of an Integrated Phishing Campaign Utilizing Google Cloud Infrastructure
A coordinated phishing operation abuses Google Cloud Storage to host a redirector HTML file at storage.googleapis.com, allowing emails to sail through SPF/DKIM checks while pointing to seemingly trustworthy Google infrastructure. The operator reuses one GCS bucket but fans out across 25+ lures, ranging from “Cloud Storage Full” and fake AV expiry to retail rewards and health offers, all converging on credit-card-harvesting pages that present low “shipping” or “service” fees. Defenders should flag storage.googleapis.com links in email, scrutinize sender metadata, and report abusive buckets like “whilewait” to Google Cloud Abuse to collapse the campaign's shared infrastructure.
Read the full story