{"id":8640,"date":"2026-01-07T15:50:52","date_gmt":"2026-01-07T19:50:52","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=8640"},"modified":"2026-01-07T15:13:30","modified_gmt":"2026-01-07T19:13:30","slug":"new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/","title":{"rendered":"New phishing threat exploits Google Cloud to harvest Microsoft 365 credentials"},"content":{"rendered":"<p><span id=\"input-sentence~0\">There\u2019s a new phishing scam out there and it\u2019s pretty clever. Hackers are using <a href=\"https:\/\/cloud.google.com\/?hl=en\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Google Cloud<\/a> tools to go after people\u2019s <a href=\"https:\/\/www.office.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Microsoft 365<\/a> login info. They hide behind legit platforms and automated messages, so their emails look real and are way harder to catch. It\u2019s getting tougher to tell what\u2019s fake.<\/span><\/p>\n<p><span id=\"input-sentence~1\">Here\u2019s how it works: The scammers use Google Cloud Application Integration, which is supposed to help businesses automate stuff. But these guys send emails from actual Google addresses, like noreply-application-integration@google[.]com. That makes the message seem official. Most of the time, the emails look like normal notifications\u2014maybe a shared doc or a voicemail alert. People see them, don\u2019t think twice, and click the links. That\u2019s all it takes.<\/span><\/p>\n<p><span id=\"input-sentence~2\">The attack follows a multi-stage path designed to evade security filters. When someone clicks the link, they land on a real Google Cloud Storage page first. Then the process triggers a quick \u201cprove you\u2019re human\u201d step, usually a CAPTCHA or an \u201cI\u2019m not a robot\u201d check, which googleusercontent[.]com hosts. This bit weeds out security bots and makes the whole thing look more legit. After that, attackers redirect people to a fake <a href=\"https:\/\/hostingdiscussion.com\/news\/austria-says-microsoft-broke-privacy-laws-by-tracking-students-via-365-education\/\">Microsoft 365<\/a> login page that looks almost identical to the real one but secretly captures their login credentials.<\/span><\/p>\n<p><span id=\"input-sentence~3\">Researchers say attackers are taking advantage of free Google Cloud credits. That makes it cheap and easy to run these scams at scale. It\u2019s not just about the tech, either\u2014these criminals are pretty crafty with psychology, using trusted sites to trick people into letting their guard down.<\/span><\/p>\n<p><span id=\"input-sentence~4\">Google pointed out that this isn\u2019t a breach of their systems. Instead, <a href=\"https:\/\/hostingdiscussion.com\/news\/ai-adoption-forces-cloud-security-teams-into-constant-catch-up-mode\/\">attackers<\/a> are misusing their workflow automation tools. Security experts say it\u2019s smart to double-check URLs, use multi-factor authentication, and keep employees trained to spot shady emails. At this point, everyone should expect phishing attacks to get more advanced and plan their defenses with that in mind.<\/span><\/p>\n<p><span id=\"input-sentence~5\">This whole scheme is a reminder: even big-name platforms can be twisted into tools for stealing sensitive info. Companies that mix strong technical defenses with regular awareness training give themselves a much better shot at stopping account takeovers and cutting down the fallout. Staying alert and keeping a close eye on things is more important than ever in a world that runs on the cloud.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>There\u2019s a new phishing scam out there and it\u2019s pretty clever. Hackers are using Google Cloud tools to go after people\u2019s Microsoft 365 login info. They hide behind legit platforms and automated messages, so their emails look real and are way harder to catch. It\u2019s getting tougher to tell what\u2019s fake. Here\u2019s how it works: [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[5359,4947,5327,2772,5360],"class_list":["post-8640","post","type-post","status-publish","format-standard","hentry","category-featured","tag-cloud-cybersecurity-threats","tag-credential-theft","tag-google-cloud-phishing","tag-microsoft-365","tag-workflow-automation-attacks"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>New phishing threat exploits Google Cloud to harvest Microsoft 365 credentials - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New phishing threat exploits Google Cloud to harvest Microsoft 365 credentials - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"There\u2019s a new phishing scam out there and it\u2019s pretty clever. Hackers are using Google Cloud tools to go after people\u2019s Microsoft 365 login info. They hide behind legit platforms and automated messages, so their emails look real and are way harder to catch. It\u2019s getting tougher to tell what\u2019s fake. Here\u2019s how it works: [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-07T19:50:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-07T19:13:30+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/\",\"name\":\"New phishing threat exploits Google Cloud to harvest Microsoft 365 credentials - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-01-07T19:50:52+00:00\",\"dateModified\":\"2026-01-07T19:13:30+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New phishing threat exploits Google Cloud to harvest Microsoft 365 credentials\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New phishing threat exploits Google Cloud to harvest Microsoft 365 credentials - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/","og_locale":"en_US","og_type":"article","og_title":"New phishing threat exploits Google Cloud to harvest Microsoft 365 credentials - Web Hosting News","og_description":"There\u2019s a new phishing scam out there and it\u2019s pretty clever. Hackers are using Google Cloud tools to go after people\u2019s Microsoft 365 login info. They hide behind legit platforms and automated messages, so their emails look real and are way harder to catch. It\u2019s getting tougher to tell what\u2019s fake. Here\u2019s how it works: [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/","og_site_name":"Web Hosting News","article_published_time":"2026-01-07T19:50:52+00:00","article_modified_time":"2026-01-07T19:13:30+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/","url":"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/","name":"New phishing threat exploits Google Cloud to harvest Microsoft 365 credentials - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-01-07T19:50:52+00:00","dateModified":"2026-01-07T19:13:30+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/new-phishing-threat-exploits-google-cloud-to-harvest-microsoft-365-credentials\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"New phishing threat exploits Google Cloud to harvest Microsoft 365 credentials"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":224,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=8640"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8640\/revisions"}],"predecessor-version":[{"id":8641,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8640\/revisions\/8641"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=8640"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=8640"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=8640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}