New Phishing Campaign Exploits Google Storage to Deliver Remcos RAT

Gbhackers •Mayura Kathir • April 9, 2026

A recently observed phishing campaign is abusing Google Cloud Storage to deliver the Remcos remote access trojan (RAT), relying on trusted Google infrastructure and a signed Microsoft binary to evade traditional defenses. Attackers host a fake Google Drive login page on the legitimate domain storage.googleapis.com, making the URL appear trustworthy to both users and security […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Exploits Google Storage to Deploy Remcos RAT A phishing campaign has been detected that exploits Google Cloud Storage to deliver the Remcos remote access trojan (RAT). Attackers host a fake Google Drive login page on the legitimate domain storage.googleapis.com, which appears trustworthy to users and security tools. The phishing page collects user credentials, including email, password, and one-time passcode. Upon successful login, victims are prompted to download a malicious JavaScript file that initiates a multi-stage attack chain. This chain includes executing VBS scripts and using a legitimate Microsoft binary, RegSvcs.exe, to inject the Remcos payload into memory, making detection challenging. The use of trusted infrastructure allows the phishing links to bypass many security filters. Security professionals are advised to enhance monitoring for suspicious script activity and unusual file paths. The campaign is ongoing, affecting users globally. 6 sources 68

Extracted Entities

New Phishing Campaign Exploits Google Storage to Deliver Remcos RAT

The full story

Extracted Entities

Attack Types (1)

Domains (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)