Phishing Through the Clouds: How Legitimate Cloud Services Have Become an Attacker’s Gateway
Phishing Through the Clouds: How Legitimate Cloud Services Have Become an Attacker’s Gateway
Phishing has always relied on deception. Attackers craft emails that mimic trusted senders, forge links that look legitimate, and exploit the instinct to click. But in early March 2026, a new variation emerged that upends a core assumption many organisations hold: that content hosted on a legitimate, trusted domain is safe. Security researchers uncovered a sophisticated phishing campaign where attackers placed malicious redirects on Google Cloud Storage buckets, leveraging the domain storage.googleapis.com to disguise themselves as legitimate infrastructure. The twist? Each phishing email pointed to a unique URL, making pattern-based detection almost impossible. In a single attack, researchers identified 25 distinct phishing emails all converging on the same target, each with a different pathway to the attacker’s infrastructure.
This attack represents a fundamental shift in how phishing campaigns operate. Rather than exploiting weaknesses in authentication protocols or social engineering alone, attackers are now weaponising the trust organisations place in legitimate cloud providers. When an employee sees a link pointing to storage.googleapis.com, every instinct tells them it’s safe. Google is reputable. The domain is legitimate. The infrastructure is sound. Yet behind that URL lies a redirect to a credential harvester or malware payload. Standard email security filters struggle because the domain itself is whitelisted, and the initial request appears to come from a legitimate source.
The implications run deeper than a single campaign. Alongside this activity, Microsoft security researchers documented OAuth redirection abuse—where phishing emails contain OAuth authentication URLs designed to appear legitimate, then silently redirect victims to attacker-controlled infrastructure without proper user consent. Combined, these techniques reveal attackers moving away from crude mass phishing and toward surgical precision, using legitimate infrastructure as a trojan horse.
For IT teams and security leaders, the message is stark: the traditional reliance on domain reputation and URL whitelisting is no longer enough. Organisations must adapt their defences to account for a threat landscape where the attacker’s greatest asset is the appearance of legitimacy.
Legitimate Infrastructure as a Weapon: The Google Cloud Storage Campaign
The phishing campaign leveraging Google Cloud Storage reveals how attackers have evolved beyond simple social engineering. In this case, threat actors uploaded malicious redirects to GCS buckets—cloud storage repositories that are normally used for legitimate purposes like backing up data, hosting static assets, or managing shared files. By placing their payloads on storage.googleapis.com, they guaranteed two critical advantages: first, the domain would pass most email security checks, and second, email gateways would see the request as originating from Google’s infrastructure, not from an attacker’s server.
The mechanics are straightforward, yet effective. An employee receives an email that may reference a false file sharing request, a document review, or any pretext that compels them to click. The link in the email points to storage.googleapis.com followed by a unique path. When clicked, the user is redirected to a phishing site designed to harvest Microsoft 365 credentials, or alternatively, to a malware download. The attacker creates a new GCS bucket for each campaign or even each batch of targets, ensuring that security tools cannot simply blacklist a single URL. The result is a detection nightmare: each phishing email looks unique, each uses legitimate infrastructure, and the redirection happens in real time.
What makes this campaign particularly concerning is the scale of misdirection. Traditional phishing campaigns rely on shared infrastructure, meaning a single malicious domain can compromise hundreds or thousands of users. That shared infrastructure becomes a liability—once security teams identify it, they can block it organisation-wide. But in this attack, the infrastructure is legitimately Google’s. Blocking storage.googleapis.com is not an option. Instead, security teams must detect the phishing payload itself, a task made harder by the fact that the redirect happens transparently to the user.
Email threat prevention systems like Spambrella’s Predictive Sandboxing via TAP help detect such attacks by detonating suspicious links in an isolated environment, observing where they lead and what they deliver, before the email ever reaches the user’s inbox. Yet this approach also highlights a sobering truth: as attackers grow more sophisticated in their use of legitimate infrastructure, email filtering alone becomes insufficient. Organisations must layer their defences with user awareness training, authentication controls, and rapid incident response protocols.
OAuth Abuse: Phishing Without Stealing Tokens
Parallel to the Google Cloud Storage campaign, attackers have refined their approach to OAuth authentication redirects. Rather than attempting to steal OAuth tokens directly—a task that modern OAuth implementations have made increasingly difficult—threat actors now use OAuth authentication flows as a trust signal within phishing emails. An email arrives with a subject line referencing a document that requires electronic signature, a financial statement that needs review, or a government notice that demands immediate action. The link in the email contains an OAuth authentication URL, which at first glance appears legitimate: the user sees a prompt to authenticate through a trusted provider like Google, Microsoft, or Okta.
The sophistication lies in how these URLs are weaponised. Attackers register OAuth applications with minimal vetting, or they misuse legitimate OAuth scopes to redirect users silently. In one documented technique, threat actors intentionally specify invalid or unusual OAuth scopes, which causes the authentication flow to fail or behave unexpectedly. The user, seeing a failed authentication, may assume there was a temporary glitch and reattempt the login—only to be redirected to attacker-controlled infrastructure on the second attempt. In other cases, the OAuth flow completes successfully, but the “success” redirect sends the user to a credential harvester masquerading as the legitimate service.
What distinguishes OAuth abuse from traditional phishing is the psychological credibility it confers. When a user sees a legitimate OAuth login page, they believe they are authenticating to Google, Microsoft, or their employer’s identity system. The attacker is not trying to fool them with fake branding; instead, the attacker is using the real OAuth infrastructure, allowing users to authenticate through legitimate channels before being redirected to the malicious endpoint. By the time the user realises something is amiss, they may have already entered sensitive information or granted permissions they didn’t intend to grant.
The targeting in these campaigns is surgical. Microsoft researchers observed these attacks concentrated on government and public-sector organisations, suggesting advanced threat actors are using OAuth abuse as a tool for espionage or credential harvesting to support follow-on attacks. Private-sector organisations cannot afford complacency; BEC (Business Email Compromise) attacks, which often begin with credential compromise, affect organisations across every industry. Security awareness training that teaches users to scrutinise OAuth prompts, even when they appear legitimate, is essential. So too is enabling multi-factor authentication (MFA) on all accounts that support it—a step that renders stolen credentials far less valuable to attackers.
The Collapse of Trust Signals in Email
Both the Google Cloud Storage campaign and OAuth abuse highlight a broader erosion of traditional email security trust signals. For decades, organisations have relied on a simple heuristic: trust domains that are reputable, block domains that are suspicious. Email filters have been built on this assumption, and user training has reinforced it. “Be wary of unknown senders, but if the email comes from a recognisable company domain, it’s probably legitimate.” That intuition is now a liability.
The problem is not that legitimate domains can be compromised—that has always been true. Instead, the problem is that attackers have found ways to use legitimate domains without compromising them. A Google Cloud Storage bucket is not a compromised Google service; it’s a legitimate service misconfigured or misused by an attacker. An OAuth authentication page is not a hacked identity provider; it’s a real authentication flow being leveraged in an unexpected way. These are not failures of Google, Microsoft, or the cloud providers themselves; they are failures of organisations to monitor how their services are being used.
For email security, this represents a fundamental challenge. Traditional spam and phishing filters rely heavily on reputation-based filtering: whitelisting known good domains, blacklisting known bad domains, and scoring intermediate domains based on past behaviour. But as attacks increasingly originate from legitimate infrastructure, reputation-based approaches become less effective. An email pointing to storage.googleapis.com scores well because the domain is legitimate. An OAuth URL scores well because it points to a real identity provider. The attack succeeds not because the email security system failed, but because the email security system—and the user—trusted what appeared to be trustworthy.
Combating this requires shifting the burden of threat detection from reputation to behaviour. Instead of asking “is this domain reputable?”, organisations must ask “does this email request unusual action?” or “is this link going where the user expects?” Spambrella’s inbound email threat protection incorporates advanced link analysis and dynamic URL inspection to identify redirects and suspicious redirections, even when the initial domain appears legitimate. Coupled with user awareness training that emphasises verifying requests through independent channels—calling the sender directly, logging into accounts through bookmarks rather than email links—organisations can rebuild a defensible posture even as traditional trust signals erode.
Building a Layered Defence Against Cloud-Based Phishing
No single tool can defend against the full spectrum of modern phishing attacks. Email filters catch most threats, but sophisticated campaigns will slip through. User awareness training educates employees to spot fakes, but even trained users can be deceived under time pressure or by especially creative social engineering. And traditional authentication, even when strong, is vulnerable to credential theft if users can be tricked into entering their credentials on a fake page. The only reliable defence is a layered approach that acknowledges each defence’s limitations and compensates for them.
The first layer remains email filtering, but it must be sophisticated. Basic content filtering and signature-based detection are insufficient. Modern email security systems employ sandboxing, where suspicious attachments and links are detonated in an isolated environment to determine their true intent before they reach the user. Organisations using Spambrella’s Predictive Sandboxing via TAP benefit from this approach, which can identify redirect chains and detect when a legitimate-looking link ultimately leads to a phishing site or malware payload. The second layer is user awareness training, but training must evolve. Rather than teaching users to spot fake logos or misspelled domains—skills that matter less when phishing emails use legitimate infrastructure—training should emphasise verifying unusual requests through independent channels and recognising social engineering tactics like artificial urgency, threats, or authority manipulation.
The third layer is authentication and access control. Multi-factor authentication (MFA) remains the single most effective mitigation against credential-based attacks. If an employee enters their password into a phishing site, but the attacker still cannot access their account because MFA blocks the login attempt, the attack fails. Organisations should prioritise MFA for critical accounts first—email, identity systems, financial systems—then expand to all users. Conditional access policies, which restrict access based on user behaviour, location, or device health, add another obstacle for attackers operating stolen credentials.
The fourth layer is monitoring and response. Even with strong preventative controls, some attacks will succeed. Organisations should monitor for unusual account behaviour—logins from unexpected locations, mass forwarding rules, suspicious file shares—and maintain incident response procedures that can rapidly contain compromised accounts. Security operations teams should review email logs not just for blocked threats, but for messages that reached users despite security controls, learning from each incident to improve future defences.
Implementing all four layers requires investment, coordination, and ongoing effort. But the alternative—hoping that reputation-based filtering and user intuition will suffice—is no longer defensible in an environment where attackers use legitimate infrastructure as a weapon.
Phishing and Cloud Security: The Bottom Line
The emergence of phishing campaigns leveraging legitimate cloud services marks a decisive moment in the evolution of email security threats. Attackers have moved beyond exploiting vulnerabilities in email authentication or human psychology alone; they are now weaponising the trust organisations place in cloud providers and the infrastructure those providers operate. Google Cloud Storage buckets, OAuth flows, and other legitimate services become, in the hands of attackers, perfect vehicles for phishing because they arrive wearing the uniform of trust.
For organisations, the implications are sobering. Traditional email security approaches that rely on domain reputation, whitelist management, and user education are necessary but sufficient. As the threat landscape evolves, so too must the defences. Email filtering systems must incorporate advanced link analysis and sandboxing. User awareness training must adapt to teach users to verify requests through independent channels and to distrust unusual requests even when they appear to originate from legitimate infrastructure. Authentication controls must evolve to assume breach, with multi-factor authentication deployed broadly and access policies updated to reflect modern attack patterns.
The good news is that sophisticated, determined attackers are still a minority. Most phishing remains crude, relying on bulk campaigns and basic social engineering. For organisations willing to invest in layered defences—modern email security, user training, strong authentication, and incident response capabilities—the risk of compromise from email-based phishing can be substantially reduced. The key is to move beyond a single-control mindset and towards defence in depth, where multiple layers compensate for each other’s weaknesses. Cloud-based phishing will not be the last evolution in email-based attacks, but it is a clear signal that the next generation of threats will demand a more sophisticated defence.
FURTHER READING
