Phishing Attacks Abusing Domains on Google Cloud

Zscaler ThreatLabZ observed an active phishing campaign using Google Appspot and Web.app subdomains to host convincing, SSL-enabled credential-harvesting pages that impersonate enterprise services (Dropbox, Outlook/OneDrive, DocuSign). Attackers evade detection by offloading core logic to externally hosted, randomly named JavaScript files and minimal landing-page content; the report enumerates dozens of malicious subdomains and multiple attacker-controlled collector URLs receiving stolen credentials, and notes that many of these subdomains were not flagged by VirusTotal at the time of analysis.