Remcos RAT Delivered Through Google Cloud Storage In Email Evasion Campaign

**Executive summary:** ANY.RUN analyzed a phishing campaign that abuses Google Cloud Storage and trusted Google branding to deliver Remcos RAT via a multi-stage infection chain (JS → VBS → PowerShell), enabling credential theft, in-memory .NET payload execution, and C2 callbacks; the report warns that valid email authentication and reputable hosting allow messages to bypass traditional filters and recommends behavior-centric sandboxing and detection rules to identify script spawning chains, anomalous RegSvcs.exe activity, and Remcos-related outbound traffic.