A new phishing campaign has been discovered, leveraging Google Cloud Storage (GCS) to host malicious redirects and bypass traditional security filters.
The campaign targets individuals with various phishing emails, directing them to a fraudulent URL hosted on Google’s infrastructure, making it difficult for email security systems to detect.
This method exploits Google’s trusted platform to disguise harmful intent and increase the likelihood of success.
The Technical Infrastructure Behind the Attack
The URL at the center of this phishing attack is hosted on Google Cloud Storage (GCS) under the domain.
For the average user or a basic email security gateway, the domain googleapis.com appears legitimate since it’s a known Google-owned domain used to host cloud assets.
This specific attack involves several key components:
- The Bucket: Named whilewait, this is a custom storage container created by the attacker within Google Cloud, used to host the malicious file.
- The Payload: The comessuccess.html file is a script-heavy page that acts as a “gatekeeper” for the malicious redirect. Once a user clicks the link in the phishing email, the HTML file silently redirects the browser to a third-party, malicious website, often used for credit card harvesting or malware distribution.
By hosting the malicious page on Google’s trusted platform, the attacker bypasses standard security checks, such as SPF and DKIM, and evades detection by security systems that might block less familiar or suspicious domains.
Social Engineering Tactics
This phishing campaign is characterized by a diverse range of social engineering tactics designed to appeal to various psychological triggers. Some of the email themes identified in over 25 distinct samples include:
- Account Urgency: Emails claiming “Cloud Storage Full” or “Google Account Storage Full.”
- Security Fears: Alerts warning of a “Critical Threat Detected” or “Antivirus Protection Expired.”
- Retail Incentives: Offers claiming rewards from popular brands like Lowe’s, T-Mobile, and State Farm.
- Lifestyle & Health: Promotions for “Homemade Recipes,” “Blood Sugar Watch,” or “Neuropathy Pain” solutions.
This is the Analysis Credit Card Harvesting phase, where attackers collect payment information, leading to financial fraud.
The tactic of using scareware emails to push victims to fraudulent subscription or service portals has been a growing trend in recent phishing campaigns.
To protect against this phishing style, referred to as “Trusted-Platform Phishing,” the following steps are recommended:
- Inspect the Redirect Path: Be cautious about links that start with storage.googleapis.com, as third parties rather than Google often hosts them.
- Verify Sender Metadata: While the link may appear legitimate, the “From” address often contains randomized, unrelated alphanumeric strings.
- Report Infrastructure Abuse: Reporting the whilewait GCS bucket to the Google Cloud Abuse Team is crucial in dismantling the phishing campaign and stopping further exploitation.
| Tactic | Examples | MITRE ATT&CK Mapping |
|---|---|---|
| Pretexting | Storage full, security alerts | T1566.001: Phishing: Spearphishing Attachment |
| Baiting | Retail rewards, health promos | T1566.002: Phishing: Spearphishing Link |
| Redirect Chains | GCS → External harvester | T1021: Remote Services Abuse |
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 to host malicious redirects and bypass traditional){kind=link}