New Phishing Campaign Exploits Google Storage to Deliver Remcos RAT

**Phishing campaign using Google Cloud Storage to host a fake Google Drive login page that captures credentials and OTPs, then delivers the Remcos RAT through a multi‑stage script chain (JS → VBS → PowerShell) and an in‑memory .NET loader that hollowes a signed RegSvcs.exe for stealth and persistence; defenders are advised to rely on behavioral EDR, monitor script chains and atypical RegSvcs.exe execution paths, and reinforce user awareness.**