Hackers Abuse Trusted Platforms to Steal Bank Credentials From Philippine Users

A coordinated phishing campaign (PHISLES) targeting Philippine online banking customers since January 2024 has distributed over 900 malicious links and confirmed more than 400 victims by using compromised real email accounts and redirect chains through trusted platforms (Google Business Profile, AMP CDN, Google Cloud Workstations, URL shorteners, Cloudflare workers/pages) and a hijacked educational domain to capture credentials and OTPs in real time and withdraw funds within minutes; the report describes the campaign’s TTPs and recommends tougher URL verification, MFA enforcement, DNS/registrar audits, and bank customer notifications.