ANY.RUN๐จ ๐ฃ๐ต๐ถ๐๐ต๐ถ๐ป๐ด ๐๐ถ๐ฎ ๐๐ผ๐ผ๐ด๐น๐ฒ ๐ฆ๐๐ผ๐ฟ๐ฎ๐ด๐ฒ ๐๐ฏ๐๐๐ฒ ๐๐ฒ๐ฎ๐ฑ๐ถ๐ป๐ด ๐๐ผ ๐ฅ๐๐ง ๐๐ฒ๐ฝ๐น๐ผ๐๐บ๐ฒ๐ป๐: ๐๐ฒ๐๐ฒ๐ฐ๐ ๐๐ ๐๐ฎ๐ฟ๐น๐
We identified a multi-stage #phishing campaign using a Google Drive-themed lure and delivering #Remcos RAT. Attackers place the HTML on storage[.]googleapis[.]com, abusing trusted infrastructure instead of hosting the phishing page on a newly registered domain.
โ๏ธ ๐ง๐ต๐ฒ ๐ฐ๐ต๐ฎ๐ถ๐ป ๐น๐ฒ๐๐ฒ๐ฟ๐ฎ๐ด๐ฒ๐ ๐ฅ๐ฒ๐ด๐ฆ๐๐ฐ๐.๐ฒ๐ ๐ฒ, ๐ฎ ๐น๐ฒ๐ด๐ถ๐๐ถ๐บ๐ฎ๐๐ฒ ๐๐ถ๐ด๐ป๐ฒ๐ฑ ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐/.๐ก๐๐ง ๐ฏ๐ถ๐ป๐ฎ๐ฟ๐ ๐๐ถ๐๐ต ๐ฎ ๐ฐ๐น๐ฒ๐ฎ๐ป ๐ฉ๐ถ๐ฟ๐๐๐ง๐ผ๐๐ฎ๐น ๐ต๐ฎ๐๐ต. Combined with trusted hosting, this makes reputation-based detection unreliable and lowers alert priority during triage. File reputation alone is not enough. Detection depends on behavioral analysis and sandboxing.
โ ๏ธ The page mimics a Google Drive login form, collecting email, password, and OTP. After a โsuccessful login,โ the victim is prompted to download Bid-Packet-INV-Document.js, triggering a multi-stage delivery chain:
JS (WSH launcher + time-based evasion) โก๏ธ VBS Stage 1 (download + hidden execution) โก๏ธ VBS Stage 2 (%APPDATA%\WindowsUpdate + Startup persistence) โก๏ธ DYHVQ.ps1 (loader orchestration) โก๏ธ ZIFDG.tmp (obfuscated PE / Remcos payload) โก๏ธ Textbin-hosted obfuscated .NET loader (in-memory via Assembly.Load) โก๏ธ %TEMP%\RegSvcs.exe hollowing/injection โก๏ธ Partially fileless Remcos + C2 ๐จ
๐จโ๐ป See the analysis session and collect #IOCs to speed up detection and response: https://app.any.run/tasks/0efd1390-c17a-49ce-baef-44b5bd9c4a97/?utm_source=mastodon&utm_medium=post&utm_campaign=google_storage_abuse_phishing&utm_term=080426&utm_content=linktoservice
๐ Use this TI Lookup query to pivot from IOCs, review related activity, and validate your detection coverage: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=google_storage_abuse_phishing&utm_content=linktotilookup&utm_term=08042026#%7B%22query%22:%22domainName:%5C%22www.freepnglogos.com%5C%22%20and%20domainName:%5C%22storage.googleapis.com%5C%22%20and%20threatLevel:%5C%22malicious%5C%22%22,%22dateRange%22:30%7D
โก๏ธ Equip your SOC with stronger phishing detection and contain incidents faster: https://any.run/phishing/?utm_source=mastodon&utm_medium=post&utm_campaign=google_storage_abuse_phishing&utm_term=080426&utm_content=linktophishingpage
