Threat Actors Abuse Microsoft & Google Platforms to Attack Enterprise Users

Enterprise security teams are facing a sophisticated new challenge as cybercriminals increasingly exploit trusted cloud platforms to launch phishing attacks.

Instead of relying on suspicious newly registered domains, threat actors now host their malicious infrastructure on legitimate services like Microsoft Azure Blob Storage, Google Firebase, and AWS CloudFront.

This strategic shift allows attackers to hide behind the reputation of trusted technology giants, making detection significantly more difficult for traditional security tools.

These campaigns specifically target corporate users rather than personal email accounts, representing a calculated effort to compromise business systems and steal sensitive enterprise credentials.

The attacks typically begin with convincing phishing emails containing links or QR codes that redirect victims through multiple layers of evasion techniques.

Many campaigns incorporate CAPTCHA challenges and…