Phishing Campaigns Abuse Trusted Cloud Platforms, Raising New Risks for Enterprises

ANY.RUN researchers describe a wave of phishing campaigns that abuse legitimate cloud/CDN hosting (Google, Microsoft, Cloudflare, Azure Blob, Firebase, AWS CloudFront) to bypass reputation-based controls and target corporate accounts; interactive sandbox execution reveals runtime behaviors (redirects, gated pages, fake Microsoft 365 logins, credential harvesting) that static analysis misses and accelerates detection and response.