Email attacks featuring Google Cloud Application Integration abuse and captcha.html · Blog · Sublime Security

Sublime’s Attack Spotlight details a credential-phishing campaign that leverages Google Cloud Application Integration to send authenticated-looking emails and hosts an LLM-generated, multi-challenge CAPTCHA on Google Cloud Storage to filter bots before redirecting victims to credential phishing pages; the report describes the attack flow, the CAPTCHA’s bot-detection and challenge configuration, observed indicators (storage.cloud.google.com links, suspicious URLs, Google impersonation, urgency), and Sublime’s detection signals and mitigations.