New Phishing Attack Via Google Storage Deploys Remcos RAT

A phishing campaign is abusing Google Cloud Storage (googleapis.com) to host pages that impersonate Google Drive and deliver the Remcos RAT through a multi-stage infection: JavaScript redirects or automatic downloads fetch obfuscated archives, a VBScript/PowerShell dropper retrieves the Remcos payload which is injected via process hollowing and establishes persistence (e.g., `HKEY_CURRENT_USER\Software\Remcos-{ID}`) and encrypted C2. Because the attack leverages trusted Google infrastructure, email and web filters may not flag the malicious links; recommended defenses include monitoring outbound googleapis.com usage outside normal workflows, enforcing script execution policies, enabling behavioral endpoint detection, and user training to avoid unexpected links.