Topic starter
25/10/2026 11:04 am
TL;DR: Attackers are using Google Cloud Storage to host phishing redirectors and sites that exploit user trust in Google domains, according to Aryaka, while messages can still pass SPF checks and appear legitimate despite weak DKIM and DMARC enforcement. Email trust controls fail when adversaries borrow trusted cloud infrastructure, not just familiar branding.
Editorial analysis by NHI Mgmt Group, based on content published by Aryaka: “Phantoms in the Cloud: Fraudsters Exploit Google Cloud Storage for Deceptive Campaigns”.
Key questions
Q: How should security teams respond when phishing infrastructure is hosted by legitimate providers?
A: Treat the provider relationship as part of the response path.
Q: Why can SPF pass while a phishing email is still dangerous?
A: SPF only confirms that a sending server is authorised for a domain.
Q: What are the signs that cloud-hosted phishing is bypassing your controls?
A: Look for messages that use familiar branding, link through cloud storage or other reputable services, and rely on redirects or CAPTCHA before the final destination appears.
Practitioner guidance
- Harden DMARC beyond pass/fail Move from permissive or monitoring-only policy toward enforcement, and verify that DKIM alignment is required for high-risk business domains.
- Inspect redirect chains, not just domains Review email and web controls so that JavaScript redirects, multi-hop links, and CAPTCHA-gated destinations are analysed before users reach the final page.
- Treat trusted cloud hosts as abuse surfaces Create detections for phishing content hosted on cloud storage and other reputable platforms, then build escalation paths for fast takedown and provider notification.
Bottom line: The campaign shows how phishing can hide inside reputable cloud infrastructure, which weakens controls that still depend on domain reputation and familiar branding.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →