Phishing Campaign Uses Google Cloud to Host Malicious Redirects via GCS Bucket

A phishing campaign is abusing Google Cloud Storage (storage.googleapis.com/googleapis.com) by hosting a redirector (bucket 'whilewait' and file 'comessuccess.html') that appears legitimate to email filters and routes victims to fraudulent payment or malware distribution pages to harvest credit card data; researchers observed 25+ samples using diverse social-engineering lures and recommend verifying redirect chains, scrutinizing sender metadata, and reporting the malicious bucket to Google Cloud Abuse.