Phishing campaign abuses Google Cloud services to steal Microsoft 365 logins

Attackers are using Google Cloud Application Integration to send seemingly legitimate emails from [email protected] that link to Google Cloud Storage and googleusercontent.com pages (including CAPTCHAs) before redirecting victims to a fraudulent Microsoft 365 sign-in page that captures credentials; Google has blocked several campaigns and advises continued caution. Recommended defenses include verifying actual login URLs, avoiding email links, enabling multi-factor authentication, using password managers, and reporting suspicious messages to protection tools like Malwarebytes Scam Guard.