Unmasking A Novel Google Drive Phishing Chain

Personal Discovery of the Campaign

The speaker, an Amazon offensive security engineer presenting personally, recounts receiving a Google Drive iOS push notification warning his storage was nearly full—a believable premise because his Drive actually was full. The notification originated from a random Micah Dean account on driaz.onmicrosoft.com, not Google.

Attacker Infrastructure Patterns

Threat actors easily spin up Microsoft 365 tenants with multiple onmicrosoft.com domains, rotating burned infrastructure. Guardz tracking shows large numbers of randomly generated tenants used for phishing. The HTML storage alert leads victims through a multi-step chain rather than a simple email link.

Evasion and Payload Delivery

To evade email security, attackers host lures on S3 objects with redirectors pointing to pages such as cloudstoragecentral.com hosted in Moldova, correlating with UNC5537 activity. Victims clicking secure storage are pushed toward Total Drive installers whose pre- and post-install scripts can hide malicious payloads, illustrating how trusted cloud brands cloak affiliate scam delivery.