Phishing campaign abuses Google Cloud services to steal Microsoft 365 logins

Phishing operators are abusing Google Cloud services to harvest Microsoft 365 credentials, using Google Cloud Application Integration’s Send Email feature to send messages from a legitimate-looking noreply-application-integration@google[.]com address. The campaign starts with an email that mimics routine notices and directs victims to a genuine-looking Google Cloud Storage URL, keeping the link tenure plausible.

After the first click, victims are shown a CAPTCHA on a googleusercontent[.]com domain before landing on a sign‑in page that resembles Microsoft 365, but the URL is not an official Microsoft domain and any entered credentials are collected by the attackers. The use of Google's infrastructure lends credence to the phishing emails and helps bypass some filters, though the activity is described as an abuse of cloud-based services rather than a Google infrastructure compromise.

According to Google, the company has blocked several phishing campaigns involving the misuse of an email notification feature within Google Cloud Application Integration and is taking further steps to prevent misuse while encouraging continued vigilance. The article notes that attackers may be attracted by free credits for new Google Cloud customers, lowering the barrier to entry for such scams.