Threat Actors Abuse Microsoft & Google Platforms to Attack Enterprise Users

**Executive Summary:** Enterprise-targeted phishing campaigns are increasingly hosted on trusted cloud platforms (Microsoft Azure Blob, Google Firebase, AWS CloudFront) and delivered via AiTM phishing kits (Tycoon2FA, Sneaky2FA, EvilProxy) that proxy victims to legitimate authentication services to capture credentials and session tokens — even bypassing MFA; these Phishing-as-a-Service operations scale rapidly and evade traditional indicators, requiring continuous threat intelligence, behavioral analysis, and interactive sandboxing to detect.