Attackers Weaponize Trusted Cloud Services for Sophisticated Phishing Campaigns
Cybercriminals are increasingly abusing legitimate cloud platforms like Azure, Google Cloud, and AWS to host phishing infrastructure, making malicious traffic appear legitimate and bypassing traditional security measures.
Attackers are evolving their tactics, increasingly leveraging trusted cloud services such as Microsoft Azure, Google Firebase, Google Cloud Storage, Amazon Web Services, and Cloudflare to host their phishing infrastructure. This strategy, dubbed "Trusted Infrastructure Phishing," aims to make malicious traffic indistinguishable from legitimate business activity, posing a significant threat, particularly to the financial sector.
Financial institutions, which rely heavily on cloud storage, document sharing, and vendor platforms, present a ready-made attack surface with inherent credibility. Recent campaigns have exploited Google Cloud Application Integration's "Send Email" feature to dispatch phishing messages directly from google.com addresses. This allows the malicious emails to pass critical authentication checks like SPF, DKIM, and DMARC, which would normally flag spoofed senders.
Victims who interact with these phishing lures are then routed through a multi-stage redirect chain. This chain often involves Google Cloud Storage links and CAPTCHA gates before ultimately landing on fake Microsoft 365 login pages hosted on AWS S3. This complex redirection scheme is designed to evade both automated security scanners and human suspicion, making detection more challenging.
Beyond email delivery, threat actors are embedding adversary-in-the-middle (AiTM) phishing kits within legitimate content delivery networks and cloud subdomains. These kits act as proxies, sitting between the victim and the legitimate service, enabling them to capture not only credentials but also live authentication tokens. This allows attackers to bypass multi-factor authentication (MFA) entirely, a particularly acute problem for financial firms where a compromised session can lead to the exposure of sensitive transaction data.
Traditional email gateways and domain reputation tools offer limited protection against these tactics because the underlying infrastructure is legitimate. Consequently, defense strategies must shift towards post-delivery behavioral analysis. This includes monitoring click telemetry, analyzing redirect chains, and detecting anomalous authentication events after a link has been opened.
The financial sector is already a prime target, with financial organizations exhibiting higher phishing investigation rates than the global average. This is partly due to the proliferation of malware families like Tycoon2FA, Sneaky2FA, and EvilProxy, which specialize in session and token theft, as highlighted in recent reports.
To combat this evolving threat, security teams are urged to move beyond domain-based trust models. Recommended defenses include deploying cloud access security brokers (CASBs) to monitor application usage, auditing OAuth and third-party application permissions, enforcing phishing-resistant MFA like FIDO2 keys, and treating unusual login patterns as primary detection signals.
As generative AI continues to reduce the stylistic tells of phishing attempts, the combination of AI-polished lures and cloud-hosted infrastructure represents the default playbook for attackers targeting the financial sector. Robust countermeasures such as out-of-band transaction verification, strict enforcement of email authentication policies, and continuous behavioral monitoring remain critical.