Back Reddit

Phishing Lures Utilizing a Single Google Cloud Storage Bucket

Reddit •/u/anuraggawande • March 3, 2026

I have documented a campaign consisting of more 25 distinct phishing variants that all converge on a single Google Cloud Storage (GCS) infrastructure point. Core Infrastructure: Primary Host: storage/.googleapis/.com Bucket/Object: /whilewait/comessuccess.html Analysis Highlights: Evasion Strategy: The campaign utilizes the inherent trust of the googleapis/.com domain to bypass SPF/DKIM-based reputation filters and secure email gateways (SEGs). Lure Variance: Social engineering hooks include Scareware (Storage Full/Threat Detected), Retail Rewards (Lowe's/T-Mobile), and Lifestyle/Medical lures. Redirect Logic: The comessuccess.html file serves as a centralized gatekeeper, redirecting traffic to secondary domains designed for Credit Card (CC) harvesting via fraudulent subscriptions. submitted by /u/anuraggawande [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Campaign Leverages Google Cloud Storage for Malicious Redirects A phishing campaign has been identified that exploits Google Cloud Storage (GCS) to host malicious redirect links. By utilizing a legitimate Google-owned domain, attackers are able to bypass email security measures, affecting users who receive these fraudulent emails. The campaign features over 25 distinct phishing variants targeting unsuspecting victims. 5 sources 27

Extracted Entities

Phishing Lures Utilizing a Single Google Cloud Storage Bucket

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)