Hackers abuse Google Cloud Run in massive banking trojan campaign

Researchers observed a large-scale campaign abusing Google Cloud Run to host phishing links and distribute banking trojans (Astaroth, Mekotio, Ousaban) that target financial institutions across Latin America; delivery uses malicious MSI installers or redirects to Cloud Storage, BITSAdmin for second-stage payloads, and persistence via Startup LNK files executing AutoIT, enabling credential theft (keylogging, screen capture, clipboard monitoring) and evasion—Google has removed offending links and is reviewing mitigations.