Phishing Attacks Against Financial Firms Abuse Trusted Cloud Services

Key Takeaways

• Financial sector organizations are facing a surge in sophisticated phishing attacks that leverage trusted cloud infrastructure.
• Attackers are abusing legitimate services from Google Cloud, Microsoft 365/Azure, and Amazon Web Services (AWS) to host phishing lures and bypass email security.
• Advanced Adversary-in-the-Middle (AiTM) toolkits like Tycoon2FA, Sneaky2FA, and EvilProxy are being deployed to steal session cookies and circumvent multi-factor authentication (MFA).
• The increasing sophistication, partly fueled by generative AI, makes these phishing attempts harder to detect through traditional methods.

Sophisticated Phishing Campaigns Exploit Trusted Cloud Services to Target Financial Sector

The financial industry is currently grappling with a wave of highly advanced phishing attacks, which are increasingly exploiting legitimate cloud platforms to enhance their effectiveness and bypass traditional security measures. These campaigns are characterized by their use of trusted infrastructure from major cloud providers, making detection significantly more challenging for both users and automated systems.

Abuse of Cloud Infrastructure for Enhanced Evasion

Threat actors are strategically integrating services from Google Cloud Platform, Microsoft 365/Azure, and Amazon Web Services (AWS) into their attack frameworks. This tactic allows them to operate from domains and IP addresses that are inherently trusted, thereby circumventing conventional email security protocols such as SPF, DKIM, and DMARC.

• Google Cloud Platform: Attackers are dispatching phishing lures directly from google.com, ensuring that these malicious emails pass all standard authentication checks (SPF, DKIM, DMARC) and appear legitimate to recipients. This leverages Google’s robust infrastructure to deliver highly convincing phishing messages.
• Microsoft 365 & Azure: Malicious actors are manipulating tenant display settings and utilizing subdomains within Microsoft’s ecosystem. By routing their attacks through trusted Microsoft cloud services, they effectively bypass many mail security filters designed to flag suspicious origins.
• Amazon Web Services: Phishing campaigns are employing multi-stage redirection gates hosted on AWS S3 buckets. These setups often feature dynamic CAPTCHA checks, adding a layer of sophistication designed to thwart automated analysis and make it harder for security tools to reach the final credential harvesting page.

Advanced AiTM Toolkits Circumvent MFA

Beyond leveraging cloud hosting, these campaigns are deploying advanced Adversary-in-the-Middle (AiTM) phishing toolkits to overcome one of the most significant security barriers: multi-factor authentication (MFA). Tools such as Tycoon2FA, Sneaky2FA, and EvilProxy are central to these operations.

These sophisticated toolkits are designed to intercept session cookies and live authentication tokens. By doing so, they effectively bypass MFA mechanisms, allowing attackers to gain unauthorized access to accounts even when users have correctly entered their second factor. This capability represents a critical threat, as MFA is widely considered a cornerstone of modern identity security.

Evolving Threat Landscape and Mitigation Challenges

The increasing sophistication of these phishing attempts is further amplified by advancements in generative AI. Artificial intelligence is now being used to refine phishing lures, eliminating grammatical errors and stylistic inconsistencies that once served as tell-tale signs for users. This makes AI-polished lures, combined with cloud-hosted infrastructure, a formidable and increasingly common playbook for attackers targeting the financial sector.

To combat these evolving threats, robust countermeasures are essential. These include implementing out-of-band verification for all financial transactions, rigorously enforcing email authentication policies, and maintaining continuous behavioral monitoring. Such strategies are crucial for closing visibility gaps associated with hijacked authentication sessions and detecting anomalous activity.

What You Should Do

• Implement FIDO2 MFA: Deploy hardware-based FIDO2 security keys where possible, as they are highly resistant to AiTM phishing attacks.
• Enhance Email Authentication: Ensure strict enforcement of DMARC policies (reject or quarantine) to prevent spoofing and improve email deliverability of legitimate mail.
• Deploy CASB Solutions: Utilize Cloud Access Security Brokers (CASB) to monitor cloud application usage, detect anomalous behavior, and enforce security policies across your cloud environment.
• Conduct Continuous Behavioral Monitoring: Implement solutions that continuously monitor user and entity behavior for signs of compromised accounts or unusual access patterns.
• Educate Users: Regularly train employees on the latest phishing tactics, especially those involving trusted cloud services and AiTM techniques, emphasizing vigilance even with seemingly legitimate emails.
• Out-of-Band Verification: Establish protocols for out-of-band verification for all critical financial transactions and sensitive data access requests, using a separate, trusted communication channel.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.