Researchers have discovered that threat actors are targeting users by leveraging Google’s cloud infrastructure to infect them with malware, according to Cyware. In these campaigns, threat actors utilize the Google Cloud infrastructure service to conduct phishing by attaching Google firebase storage URLs in phishing emails. Most of the themes for the lures include payment invoices, account verifications, upgrading email accounts, change-password emails, and much more. Once the targets click on the Firebase link, they land on a supposed login page and are required to enter their credentials, which are shared with the cybercriminals.
