PUBLICACION ONLINE SOBRE ICT Y TELECOMUNICACIONES En español e inglés / spanish and english
PUBLICACION ONLINE SOBRE ICT Y TELECOMUNICACIONES En español e inglés / spanish and english
Ya contamos con más de diez mil seguidores en nuestras cuentas de X (ex-twitter), tanto en español como en inglés. Visítanos en @telecomkh y en @telecomkhen
12/12/2025 2:21 pm
«It all began with a whisper—a few unassuming emails slipping into inboxes on an ordinary Tuesday morning. No bells, no whistles, nothing that would raise an eyebrow at first glance. But behind the familiar cloud service logos and meticulously crafted notifications was a new breed of phishing campaign, a product of innovation and powered by AI. This wasn’t your run-of-the-mill phishing; this was a cloud-native ambush, a direct threat to the human layer of enterprise security
By Dr Aditya K Sood, Head of Aryaka’s Threat Research Labs and VP of Security Engineering & AI
Aryaka Threat Research Labs has uncovered a new wave of cloud-based phishing campaigns that exploit Google Cloud Storage (GCS) to host fraudulent redirectors and phishing sites. These attacks combine social engineering with the misuse of legitimate cloud infrastructure, exploiting the inherent trust users place in Google domains to execute financially motivated scams.
The campaign highlights how threat actors are bypassing enterprise defenses by exploiting gaps in email authentication. By sending messages that pass SPF checks but lack DKIM signatures and are reinforced by weak DMARC policies, attackers can deliver emails that appear legitimate to both recipients and email security systems, increasing the likelihood of successful compromise.
Let’s understand the attack model overall as discussed below:
• Email Impersonation: Attackers send phishing emails impersonating trusted services like Gmail or Google Drive, using professional messaging and convincing subject lines (e.g., «Subscription Termination Notice»).
• GCS-Hosted Redirects: Emails link to Google Cloud Storage (GCS) hosted HTML files that execute JavaScript redirects in the victim’s browser, bypassing static scanners and URL filters.
• CAPTCHA Evasion: The redirection chain includes CAPTCHA challenges to avoid automated analysis and appear legitimate to users.
• Fraudulent Reward Portals: Victims are directed to fake prize or bonus websites that prompt them to register or deposit money.
• User and Browser Data Collection: Attackers gather detailed user and browser metadata and send it to analytics platforms such as Mixpanel, Google Analytics, and Amplitude to track behavior and optimize campaigns.
• Exploitation of Trusted Cloud Infrastructure: Threat actors leverage legitimate cloud platforms to evade detection, making scams more challenging to spot and more effective at scale.
This approach highlights a growing evolution in cybercrime, where legitimate cloud platforms become part of the attack surface. Instead of hosting malicious content on suspicious domains, threat actors exploit Google’s trusted infrastructure to bypass scrutiny, making these scams harder to detect and more effective at scale.
Aryaka Threat Research Labs has responsibly disclosed this abuse to Google Cloud to support remediation and prevent further misuse of its infrastructure. We also coordinated with the Proofpoint Emerging Threats research team to ensure that detection rulesets were updated to cover this activity.
This collaborative effort, which included a mention from Emerging Threats, underscores the strength of the cybersecurity community in addressing evolving cloud-based threats. It’s a testament to the power of collective defense and the importance of sharing intelligence for the greater good.
This research reinforces a critical truth: trust, when abused, becomes one of the most potent enablers of deception in the cloud era.»
Above, Dr Aditya K Sood, Head of Aryaka’s Threat Research Labs and VP of Security Engineering & AI
Publicación online sobre telecomunicaciones y tecnologías de la información, en castellano e inglés / Online publication about telecommunications and ICT, in english and spanish
Multipurpose Magazine Pro Wordpress Theme 2018 | All Rights Reserved Design & Developed by Themesglance
