Cybercriminals are getting more sophisticated in how they target financial institutions, increasingly using respected cloud platforms—like Microsoft Azure, Google Cloud, AWS, and Cloudflare—as shields for their phishing schemes. This new trend, known as “trusted infrastructure phishing,” replaces attacker-owned websites and domains with officially sanctioned cloud services to make scams look innocuous. Every step from initial contact to credential harvesting now uses systems that financial firms trust inherently, making detection much harder.
How Attack Campaigns Work
In one tactic, phishers abuse Google Cloud’s legitimate “Send Email” tool to send phishing emails from google.com addresses. These emails sail through strict email-authentication checks like SPF, DKIM, and DMARC—mechanisms normally used to keep spoofed messages out of inboxes. When recipients click on malicious links, they’re routed through Google Cloud Storage, forced through a CAPTCHA gate, and finally led to counterfeit Microsoft 365 login pages hosted on AWS S3. This multi-stage chain is engineered both to fool technology defenses and evade user suspicion.
Attackers also manipulate Microsoft 365 tenants—tweaking displayed names or routing messages through Microsoft-owned subdomains—to lend their phishing lures legitimacy. In both environments, phishing emails appear to come from verified sources, making it easier to bypass content filters and domain reputation tools.
Beyond Phishing Emails: Token Theft & Session Hijacking
Phishing is no longer just about stealing passwords. Threat actors are embedding “adversary-in-the-middle” (AiTM) tools inside content delivery networks and subdomains on cloud platforms to grab live tokens and credentials. These kits act as proxies, sitting invisibly between the user and the real service. That means even multi-factor authentication (MFA) can be defeated if the attacker steals session tokens or hijacks active sessions. Such tools—like Tycoon2FA, Sneaky2FA, and EvilProxy—are specifically built to bypass MFA, leaving financial firms vulnerable in ways traditional phishing doesn’t reach.
These campaigns are especially dangerous because nearly every stage seems legitimate. Email gateways and reputation-based tools are largely blind to these attacks, since the infrastructure is official. Security teams must instead monitor behavior after delivery. Clues can include anomalous authentication events, unusual access patterns, and redirect chains that involve trusted cloud services. Behavioral telemetry and domain-agnostic detection strategies are becoming essential.
What Organizations Can Do
For financial institutions, hardening defenses means more than standard tools. A few recommended strategies include:
- Deploying cloud access security brokers (CASBs) to monitor both approved and unauthorized app usage across cloud platforms.
- Auditing OAuth and third-party app permissions in environments like Microsoft 365 and Google Workspace.
- Using phishing-resistant MFA, such as FIDO2 security keys, rather than relying solely on SMS or TOTP-based methods.
- Treating weird login times or unexpected geographic access as key signals—not just afterthoughts.
Additional support can come from enterprise-grade threat intelligence systems, which help close the visibility gaps that this kind of cloud-based phishing aims to exploit.
One accelerating factor making these attacks more effective is the rise of generative AI. Tools are polishing the language and style of lures, removing many of the giveaways users once relied on. Paired with infrastructure tricks, this technique is becoming the default for phishing operations aimed at finance.
Defensive measures like out-of-band verification for sensitive financial actions, stricter email authentication policies, and continuous behavioral monitoring currently offer the strongest shields. But organizations that rely only on legacy protections may find themselves increasingly exposed.
As threat actors shift to using trusted cloud infrastructure in place of malicious domains, financial institutions are facing a structural challenge. Monitoring downstream behavior—such as login geography, redirect paths, and token anomalies—may be more important than ever. What to watch next: how regulatory or platform-level enforcement might force cloud providers to more aggressively police abuse of their services.
