New Phishing Attack Via Google Storage Deploys Remcos RAT

Cybersecuritynews •Tushar Subhra Dutta • April 9, 2026

A newly identified phishing campaign is using Google Cloud Storage to deliver Remcos RAT — a powerful remote access trojan — to unsuspecting victims across the globe. Attackers are abusing the trust that users and security tools place in Google’s infrastructure, making this threat particularly hard to detect and block at the network level. Phishing […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Exploits Google Storage to Deploy Remcos RAT A phishing campaign has been detected that exploits Google Cloud Storage to deliver the Remcos remote access trojan (RAT). Attackers host a fake Google Drive login page on the legitimate domain storage.googleapis.com, which appears trustworthy to users and security tools. The phishing page collects user credentials, including email, password, and one-time passcode. Upon successful login, victims are prompted to download a malicious JavaScript file that initiates a multi-stage attack chain. This chain includes executing VBS scripts and using a legitimate Microsoft binary, RegSvcs.exe, to inject the Remcos payload into memory, making detection challenging. The use of trusted infrastructure allows the phishing links to bypass many security filters. Security professionals are advised to enhance monitoring for suspicious script activity and unusual file paths. The campaign is ongoing, affecting users globally. 6 sources 68

Extracted Entities

New Phishing Attack Via Google Storage Deploys Remcos RAT

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)