Threat Actors Leversges Google Cloud Services to Steal Microsoft 365 Logins
A recent phishing campaign has been identified, exploiting Google Cloud services to bypass security measures and compromise Microsoft 365 login credentials. This sophisticated attack uses legitimate workflow automation tools to create phishing emails…
A recent phishing campaign has been identified, exploiting Google Cloud services to bypass security measures and compromise Microsoft 365 login credentials. This sophisticated attack uses legitimate workflow automation tools to create phishing emails that closely resemble genuine communications, posing challenges for detection by automated systems and end-users.
The attack targets organizations using cloud collaboration platforms, taking advantage of the interoperability between major service providers for large-scale credential harvesting. The primary mechanism involves the misuse of Google Cloud Application Integration, a service intended for automating business processes.
Attackers utilize the "Send Email" feature within this service to dispatch phishing emails that appear to originate from a legitimate Google address: noreply-application-integration@google[.]com. These emails, being from a verified Google domain, easily evade standard spam filters, leveraging the trust associated with Google's infrastructure.
This phishing strategy employs a multi-stage infection process. Upon clicking the link in the phishing email, victims are directed to a valid Google Cloud Storage URL rather than immediately to a malicious site, enhancing the perception of legitimacy. Subsequently, users are redirected to another Google-owned domain, googleusercontent[.]com, where they encounter a CAPTCHA or "I'm not a robot" check.
The primary mechanism involves the misuse of Google Cloud Application Integration, a service intended for automating business processes.
This intermediate step filters out automated security crawlers and primes victims to comply. After this check, users are redirected to a counterfeit Microsoft 365 login page designed to capture their credentials. Despite the page's visual similarity to the official portal, careful inspection of the URL reveals its fraudulent nature.
Google has acknowledged the misuse of their services and has blocked several related campaigns. They clarified that this activity involves the exploitation of a workflow automation tool rather than a compromise of Google's infrastructure.
It is recommended for security professionals to closely examine URLs, as the malicious landing pages are hosted on unofficial domains. Additionally, implementing robust multi-factor authentication is advised to enhance account security.
Based on reporting by Cyber Security News.