Phishing Campaigns Abuse Cloud Platforms to Target Latin America

Several financially motivated threat actors are abusing legitimate serverless cloud services to host phishing pages and deliver malware across Latin America. Google researchers identified PINEAPPLE impersonating Brazil's Receita Federal to deliver the Astaroth infostealer and FLUXROOT using Google Cloud containers to host phishing URLs and distribute Grandoreiro banking malware; Google updated Safe Browsing detections and disrupted these campaigns.