Scam in the Cloud: Exploiting Google Cloud Storage

This technical report examines how fraudsters exploit Google Cloud Storage (GCS) to conduct deceptive campaigns. It begins by detailing the typical structure of scam emails that appear legitimate, often mimicking notifications from trusted services. The report explains the role of email authentication mechanisms such as SPF, DKIM, and DMARC in the context of these scams, highlighting how attackers can bypass these safeguards. It describes the redirection chain that users experience after clicking on malicious links, which often leads to pages requesting sensitive personal information or payments. The report outlines the broader implications of these scams, including the erosion of trust in legitimate services and the potential misuse of collected personal data. It concludes with recommendations for users and organizations to enhance security measures, such as enforcing strict DMARC policies and implementing layered security defenses to mitigate the risks associated with these evolving scams.