Banking Trojans Target Latin America and Europe Through Google Cloud Run

Researchers report a surge in high-volume phishing campaigns that weaponize Google Cloud Run and other cloud services to host and distribute banking trojans (Astaroth, Mekotio, Ousaban) and various info-stealers; attackers use malicious MSI droppers, cloud storage redirects, geofencing, QR-code lures, open redirects, and compromised email services (e.g., SendGrid) with phishing-as-a-service kits to target organizations across LATAM, Europe and specific sectors such as oil & gas.