Hackers Using Google Cloud Storage to Bypass Email Filters and Deliver Remcos RAT

A phishing campaign leverages trusted Google Cloud Storage links to host fake Google Drive login pages that harvest credentials and deliver a JavaScript downloader which executes a multi-stage infection (VBS, PowerShell, fileless .NET loader) ultimately deploying the Remcos RAT; the chain uses time-based sandbox evasion, living-off-the-land binaries (RegSvcs.exe) for process hollowing, and establishes persistence to enable credential theft, surveillance, and potential lateral movement or ransomware.