Investigating a Multi-Stage PowerShell Loader

Anurag GawandeLeave a comment

Introduction

During recent threat hunting, I identified suspicious PowerShell content being served directly from an IP address and a domain:

hxxp://203[.]188[.]171[.]166/
hxxps://dorenzaa[.]com/

Both locations returned PowerShell rather than a conventional user-facing webpage.

The PowerShell was responsible for retrieving a ZIP archive from Vercel-hosted infrastructure, extracting it locally, and executing an executable from the extracted content.

Further investigation identified additional Vercel-hosted artifacts, including executable files, ZIP archives, and heavily obfuscated PowerShell loaders. Analysis of those loaders revealed hidden PowerShell execution, dynamically constructed IEX, Base64 and XOR-based obfuscation, additional payload retrieval, and a decoy “Verification complete!” message presented to the user.

The original infection vector has not been identified. Therefore, this analysis begins from the earliest stage currently visible in my investigation and does not attempt to attribute the activity to a specific threat actor or campaign.

Initial Discovery

The investigation started with:

203[.]188[.]171[.]166
dorenzaa[.]com

Both locations were observed serving PowerShell code directly.

At the time of this analysis, VirusTotal showed no security-vendor detections for either the IP address or the domain.

However, direct inspection of the content being served from these locations revealed PowerShell responsible for retrieving and executing an additional payload.

VirusTotal detection status reflects the results available at the time of analysis and may change as vendors update their detections.

VirusTotal results for 203[.]188[.]171[.]166

VirusTotal results for dorenzaa[.]com

The lack of security vendor detections did not mean that the content being served was benign.

Direct inspection showed PowerShell code at both locations.

PowerShell served from 203[.]188[.]171[.]166

PowerShell served from dorenzaa[.]com

PowerShell Retrieves Grape2.zip

Analysis of the PowerShell showed that it creates a working directory under the victim’s local application data directory:

%LOCALAPPDATA%\jsDownload

It then retrieves:

hxxps://file-host-alpha[.]vercel[.]app/Grape2.zip

The archive is stored under the newly created directory and subsequently extracted.

The script then executes:

%LOCALAPPDATA%\jsDownload\Grape.exe

The observed SHA-256 for Grape2.zip was:

3eaf786bfb4ae5688b347511f98d74c948b7dc0749558acbdc6bbe33dcfa3a61

This established the first Vercel-hosted location identified during the investigation:

file-host-alpha[.]vercel[.]app

Further analysis of the archive and Grape.exe would be required to determine its complete functionality.

Possible Second-Stage Delivery Point

An important unanswered question is how a victim reaches 203[.]188[.]171[.]166 or dorenzaa[.]com in the first place.

These locations directly return executable PowerShell rather than presenting a typical user-facing lure.

Based on this behavior, the PowerShell-hosting URLs appear to represent second-stage delivery points.

An earlier, currently unidentified initial payload or script may be responsible for reaching these locations and executing the returned PowerShell on the victim’s machine.

The initial infection vector or first-stage payload has not been identified, so this remains an assessment rather than a confirmed complete execution chain.

Discovery of Additional Vercel-Hosted Infrastructure

During further investigation of the associated Vercel-hosted files, I identified another host:

file-host-5kidy7ph1-nyererebill-sudos-projects[.]vercel[.]app

Multiple files were observed hosted on this Vercel instance:

  • UltraToolliteSetup.exe
  • mat.zip
  • draw.zip
  • loader1.txt
  • loader2.txt
  • loader22.txt
  • 1.txt
  • 4_27_1.txt

This was particularly interesting because several of the .txt files contained PowerShell loaders or heavily obfuscated PowerShell stages.

Files hosted on the Vercel instance

The presence of these files on the same Vercel instance establishes an infrastructure relationship between the observed artifacts. It does not, by itself, establish that every file performs the same function or belongs to a single malware campaign.

loader2.txt and loader22.txt

Analysis of loader2.txt and loader22.txt showed that both files contain the same PowerShell stager. The script launches PowerShell in a hidden window, downloads loader1.txt from the Vercel-hosted location, constructs IEX (Invoke-Expression), and executes the retrieved PowerShell content.

The loader also displays a “Verification complete!” message with the title “Google.com”. This appears to act as a decoy while the PowerShell activity takes place in the background.

loader2.txt and loader22.txt have the same SHA-256, confirming that the observed files contain identical content:

f139bd347cba0b197c97ca084c224d8c779bdb9116a5327e9cf30b0f72a59530

loader2.txt / loader22.txt

PowerShell stager observed in loader2.txt and loader22.txt.

Google Verification Prompt

Verification complete!” prompt displayed by the PowerShell stager with “Google.com” as the window title.

loader1.txt: Heavy PowerShell Obfuscation

The next-stage loader1.txt file is considerably more difficult to inspect.

Rather than containing a small, immediately readable downloader, the file is heavily padded with junk code and irrelevant expressions.

The script contains large quantities of randomly named variables, unnecessary mathematical operations, fake conditions, irrelevant .NET references and other content designed to make the meaningful logic difficult to locate during manual inspection.

Obfuscated loader1.txt

Heavily padded and obfuscated PowerShell contained in loader1.txt

Despite the large amount of junk content, the meaningful decoding routine could be isolated.

The script contains embedded Base64 data, converts the data into a byte array, and applies a repeating XOR operation.

The repeating XOR key identified during analysis was: Write

Conceptually, the meaningful operation consists of:

Embedded Base64 data

  • Base64 decoding
  • Byte array
  • Repeating-key XOR (“write”)
  • Decoded PowerShell

The enormous size of the original loader is therefore misleading, the actual PowerShell recovered after deobfuscation is comparatively small.

Analysis of the heavily obfuscated loader1.txt revealed an embedded Base64-encoded payload that is decoded and processed using a repeating key XOR operation with the key write.

After removing the junk code and decoding the embedded data, the resulting PowerShell was much smaller and straightforward.

It downloads UltraToolliteSetup.exe from file-host-5kidy7ph1-nyererebill-sudos-projects[.]vercel[.]app, saves the executable as %APPDATA%\UltraToolliteSetup.exe, and executes it.

The observed SHA-256 for UltraToolliteSetup.exe is

d8620f4df9e0159a8db675868b4ed9a205638c847439f52cf1c88541d0655a64

Further analysis of the executable would be required to determine its final functionality.

Obfuscated and Deobfuscated loader1.txt

Deobfuscating 4_27_1.txt

Another heavily obfuscated PowerShell file observed on the same Vercel instance was 4_27_1.txt.

Like loader1.txt, the file contains substantial amounts of junk code and irrelevant expressions intended to make manual inspection more difficult. The sample contains repeated fake operations, random variable names and long encoded data embedded among the junk content.

Deobfuscating 4_27_1.txt revealed PowerShell responsible for retrieving draw.zip from the same Vercel-hosted infrastructure. The decoded script saves the archive as %APPDATA%\draw.zip, extracts its contents into %APPDATA%\Default, and then executes %APPDATA%\Default\draw.io.exe.

The observed payload URL was:

hxxps://file-host-5kidy7ph1-nyererebill-sudos-projects[.]vercel[.]app/draw.zip

The SHA-256 of the observed draw.zip archive was:

a25bbc466416f65726c5e3f587f69515dd003f114c1eab29fdfca7b52fbd74b1

Further analysis of draw.exe would be required to determine its final functionality.

Other Hosted Artifacts

Additional artifacts observed on the second Vercel instance included:

  • mat.zip
  • 1.txt

These files were collected during the investigation and their SHA-256 hashes are included in the IOC section below.

The presence of multiple loaders, archives and executables on the same hosting location is noteworthy, but infrastructure co-location alone is not sufficient to conclude that all of the artifacts perform the same function or represent a single campaign.

No threat actor attribution is being made based on the currently available evidence.

Observed Techniques

Across the PowerShell files analyzed so far, I observed:

  • PowerShell-based payload retrieval and execution
  • Hidden PowerShell process execution
  • Invoke-WebRequest and Copy-Item for remote content retrieval
  • Dynamically constructed IEX
  • Execution of remotely retrieved PowerShell
  • Base64-encoded data
  • Repeating-key XOR obfuscation
  • Extensive junk-code padding
  • ZIP-based payload delivery
  • Archive extraction using PowerShell
  • Execution from %APPDATA% and %LOCALAPPDATA%
  • Windows Forms-based decoy verification prompt
  • Vercel-hosted loaders and payloads

What Remains Unknown

Several important parts of the activity remain unresolved.

Most importantly, the initial infection vector has not been identified. The earliest infrastructure currently visible in this investigation, 203[.]188[.]171[.]166 and dorenzaa[.]com, directly returns PowerShell code.

This suggests that an earlier payload, command, script or other execution mechanism may be responsible for reaching these locations on the victim system. However, that preceding stage has not been observed.

The final functionality of several downloaded artifacts also requires further investigation, particularly:

Grape2.zip / Grape.exe
UltraToolliteSetup.exe
draw.zip / draw.io.exe
mat.zip

Further static and controlled dynamic analysis would be necessary to determine their final behavior and whether the individual delivery paths ultimately converge.

Indicators of Compromise

Infrastructure

  • 203[.]188[.]171[.]166
  • dorenzaa[.]com
  • file-host-alpha[.]vercel[.]app
  • file-host-5kidy7ph1-nyererebill-sudos-projects[.]vercel[.]app

Files and SHA-256

Filename: UltraToolliteSetup.exe
d8620f4df9e0159a8db675868b4ed9a205638c847439f52cf1c88541d0655a64

Filename: mat.zip
dbaf04df50088031ea64a9879c1adeee8b7e551c79dc247fa1bb4de5b263f7b4

Filename: draw.zip
a25bbc466416f65726c5e3f587f69515dd003f114c1eab29fdfca7b52fbd74b1

Filename: Grape2.zip
3eaf786bfb4ae5688b347511f98d74c948b7dc0749558acbdc6bbe33dcfa3a61

Filename: loader1.txt
fe693cc07c5d8a4d479e987e64ffb7473bd79066f3505e7f2c8f0b86815d0f08

Filename: loader2.txt
f139bd347cba0b197c97ca084c224d8c779bdb9116a5327e9cf30b0f72a59530

Filename: loader22.txt
f139bd347cba0b197c97ca084c224d8c779bdb9116a5327e9cf30b0f72a59530

Filename: 1.txt
e04487377e4f976ac18e7c1c5b22bc85e03b4423e73fd490e9d1641758faac81

Filename: 4_27_1.txt
4366679a4fea2c1bf7e29290f8e162e0db9d0707030b5b99ce870195afeb3782

loader2.txt and loader22.txt share the same SHA-256, indicating identical content under two filenames.

Observed File-System Paths

%LOCALAPPDATA%\jsDownload
%LOCALAPPDATA%\jsDownload\Grape2.zip
%LOCALAPPDATA%\jsDownload\Grape.exe

%APPDATA%\UltraToolliteSetup.exe

%APPDATA%\draw.zip
%APPDATA%\Default
%APPDATA%\Default\draw.io.exe

At the time of this analysis, several of the observed indicators and files had limited or no detection coverage on VirusTotal. These screenshots are included to document the detection state at the time of research. VirusTotal results can change over time as vendors update detections, so the screenshots should be treated as a point-in-time reference rather than a permanent verdict.

Conclusion

This investigation uncovered PowerShell-based payload delivery using Vercel-hosted infrastructure, including Grape2.zip, UltraToolliteSetup.exe, and draw.zip. Analysis of the hosted scripts revealed hidden PowerShell execution, obfuscation, dynamically constructed IEX, and a decoy “Google.com, Verification complete!” prompt. While the initial infection vector and final functionality of the downloaded executables remain unknown, the findings document multiple suspicious delivery stages and associated infrastructure that warrant further investigation.

ClickFix Site Abusing Cloudflare Pages to Deliver Lumma Stealer

Anurag GawandeLeave a comment

While looking for phishing sites, I came across a suspicious Cloudflare Pages site hosted at:

hxxps://zipsage.pages[.]dev

The site presents itself as an “Adobe Activation Guide” and instructs users to manually execute a PowerShell command, a technique commonly associated with ClickFix malware delivery.

Fake Adobe Activation Page

The landing page attempts to socially engineer users into copying and executing a malicious PowerShell command under the pretense of activating Adobe software.

The page instructs users to execute the following command:

The Base64-decoded command is:

This uses Invoke-RestMethod (irm) to download a remote PowerShell script and immediately execute it in memory using Invoke-Expression (iex).

PowerShell Stage

The retrieved PowerShell script downloads and launches a JavaScript file from the same infrastructure.

Script.ps1:

The script downloads script.js into the temporary directory and executes it silently using wscript.exe.

JavaScript Downloader

The downloaded JavaScript file is heavily obfuscated and acts as a downloader/dropper.

The script downloads:

hxxps://get-1o8.pages[.]dev/putty.exe

The payload is stored as:

%TEMP%\putty.exe

Behavior observed from the JavaScript:

  • Downloads putty.exe
  • Executes the file
  • Waits for execution to finish
  • Deletes the payload afterward
  • Deletes the script itself

This cleanup behavior likely attempts to reduce forensic evidence on infected systems.

Lumma Stealer Network Activity

During execution, the sample generated multiple DNS and HTTP requests associated with Lumma Stealer infrastructure.

Observed domains:

sustainskelet[.]lat
sweepyribs[.]lat
grannyejh[.]lat
discokeyus[.]lat
necklacebudi[.]lat
energyaffai[.]lat
aspecteirs[.]lat
crosshuaht[.]lat
rapeflowwj[.]lat

The payload repeatedly generated POST requests to /api endpoints across multiple .lat domains, behavior consistent with Lumma Stealer activity.

IOC

URLs

hxxps://zipsage.pages[.]dev
hxxps://get-1o8.pages[.]dev/script.ps1
hxxps://get-1o8.pages[.]dev/script.js
hxxps://get-1o8.pages[.]dev/putty.exe

Domains

get-1o8.pages[.]dev
zipsage.pages[.]dev
sustainskelet[.]lat
sweepyribs[.]lat
grannyejh[.]lat
discokeyus[.]lat
necklacebudi[.]lat
energyaffai[.]lat
aspecteirs[.]lat
crosshuaht[.]lat
rapeflowwj[.]lat
steamcommunity.com

File Hash

MD5: 3b8d7692966df16dde1da2887378e062

Dropped File

%TEMP%\putty.exe

Fake Microsoft Teams Download Page Delivers ClickFix Chrome Update Payload

Anurag Gawande1 Comment

Recently, I came across another ClickFix-style campaign pretending to install a Chrome security update. The campaign was hosted on:

teams-net-calls[.]com

The site impersonates a legitimate Microsoft Teams download page and attempts to trick users into manually executing a malicious PowerShell command under the guise of installing a browser security update.

When accessing the site, the victim initially sees what appears to be a legitimate Microsoft Teams download page. The page itself looks clean and convincing, using Microsoft branding and a fake Teams download interface.

However, the malicious behavior does not trigger immediately. The ClickFix flow is activated only after the user interacts with the page by clicking somewhere on it. After the click, the site displays a fake Chrome update popup claiming that a critical browser security update is required.

Requiring user interaction before displaying the malicious prompt may help the campaign avoid automated sandbox analysis and reduce detection by security crawlers that do not fully interact with page elements.

The popup then walks the user through a series of steps instructing them to manually execute a PowerShell command:

  • Press Win + X
  • Open PowerShell / Terminal
  • Paste the copied command
  • Press Enter

This social engineering approach avoids traditional browser download warnings because the victim manually executes the payload themselves.

After following the instructions, the victim ends up executing the following PowerShell command:

At first glance, the script looks somewhat harmless because it downloads a legitimate old Node.js package directly from the official Node.js website:

hxxps://nodejs[.]org/dist/v7.10.1/node-v7.10.1-win-x64.zip

However, the second downloaded archive reveals the actual payload:

hxxps://instantwebupdate[.]com/get_update?i=77669

The script extracts both archives into:

C:\ProgramData\

and silently launches:

C:\ProgramData\node−v7.10.1−win−x64\node.exeC:\ProgramData\Update.jsC:\ProgramData\node-v7.10.1-win-x64\node.exe C:\ProgramData\Update.js

using hidden PowerShell execution flags such as:

-ExecutionPolicy Bypass
-WindowStyle Hidden

The JavaScript payload itself is interesting because it uses a large fake “poem” style wordlist to hide embedded files. Instead of storing binaries directly, the malware reconstructs files from mapped words and writes them to disk during execution.

The payload creates the following folder:

C:\ProgramData\Microsoft Edge Updates Helper cgpIJPjs25zk\

and drops several files inside it:

Microsoft Edge Updates Helper.exe
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
cgpIJPjs25zk.bat

The dropped executable masquerades as a Microsoft Edge helper component.

The BAT file is then used to establish persistence through the Windows Run registry key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

using the value:

Microsoft Edge Updates Helper

Interestingly, static analysis of the executable revealed references related to Revo Registry Cleaner / RevoSrp development paths:

D:\Work_REVO\VSRevo\Windows\Projects\Registry Cleaner\

along with strings such as:

System restore point created successfully.
VS REVO GROUP OOD
http://www.revouninstaller.com

The bundled DLLs (msvcp140.dll, vcruntime140.dll, and vcruntime140_1.dll) appear to be legitimate Visual C++ runtime dependencies rather than standalone malicious DLLs. They were likely included to ensure the dropped executable runs properly on victim systems.

At the time of analysis, no obvious C2 URLs were identified inside the EXE itself. Most visible URLs were related to Microsoft or DigiCert certificate infrastructure.

IOCs

Domains / URLs

teams-net-calls[.]com
hxxps://instantwebupdate[.]com/get_update?i=77669
hxxps://nodejs[.]org/dist/v7.10.1/node-v7.10.1-win-x64.zip

Dropped Files

C:\ProgramData\Update.js
C:\ProgramData\chrome.zip
C:\ProgramData\Update.zip

C:\ProgramData\Microsoft Edge Updates Helper cgpIJPjs25zk\

Persistence

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value: Microsoft Edge Updates Helper

SHA256

Microsoft Edge Updates Helper.exe
8b94af60bb58bc1629edb3b4f6a86ccff5769bb9b96d8826f06686af2d7fc55f

msvcp140.dll
18cbbc60e8989d90a50dc9373f081cf36d783f38a0aec4cd6e45d4974aa8463d

vcruntime140.dll
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

vcruntime140_1.dll
7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7

Ongoing Phishing Campaign Abusing Google Cloud Storage to Redirect Users to Multiple Scam Pages

Anurag Gawande1 Comment

A few days ago, I published a blog analyzing a phishing campaign abusing Google Cloud infrastructure:

Analysis of an Integrated Phishing Campaign Utilizing Google Cloud Infrastructure

While continuing to monitor the infrastructure used in that campaign, I discovered several additional URLs hosted on Google Cloud Storage (storage[.]googleapis[.]com) that appear to be part of the same ecosystem. These pages act as intermediate redirectors, sending victims to a wide variety of phishing and scam sites hosted primarily on the .autos TLD.

What is interesting is that a single Google Cloud Storage page appears to function as a central redirect hub, distributing victims across multiple scam themes such as fake surveys, reward scams, antivirus alerts, job offers, and account storage warnings.

Newly Observed Google Cloud Storage URLs

The following URLs were identified during the investigation:

storage[.]googleapis[.]com/whilewait/successcomes.html
storage[.]googleapis[.]com/sndrr/strow.html
storage[.]googleapis[.]com/noonchi/noon.html
storage[.]googleapis[.]com/sndrr/hmd.html
storage[.]googleapis[.]com/wetaobao/taobao.html
storage[.]googleapis[.]com/savelinge/goforward.html
storage[.]googleapis[.]com/lithesome/stepupnow.html

One particular page stood out during analysis:

This page appears to function as a traffic distribution page, redirecting visitors to multiple phishing sites depending on campaign configuration.

storage[.]googleapis[.]com/whilewait/successcomes.html

I also shared an earlier observation on X (Twitter):

Traffic Redirection to .autos Phishing Domains

The redirector page was observed sending users to various phishing domains, most of which are hosted under the .autos top-level domain.

These phishing sites are themed around different scams designed to lure victims into providing personal or financial information.

Below are the different campaign themes identified.

Netflix Reward Phishing Pages

Some pages impersonate Netflix reward programs, claiming users have won prizes or special promotions.

Domains involved:

digital-shift-us-bin[.]autos
searchonboardloadingrock[.]autos
mailanalyticsvolseries[.]autos
verifieddreamseriesultimate[.]autos
goldavgpenb[.]autos
alt-dig-gold-tab[.]autos
bio-easy-pe-loading[.]autos
analytics-mail-post-quite[.]autos
favouritebiochoicelife[.]autos

Additional domains were also shared by an X user @skocherhan quoting my earlier post:

Additional domains observed:

goldavgpenb[.]autos
alt-dig-gold-tab[.]autos
bio-easy-pe-loading[.]autos
analytics-mail-post-quite[.]autos
favouritebiochoicelife[.]autos

These pages typically present users with messages claiming they have been selected for a Netflix reward or promotional giveaway, encouraging them to complete a short survey to claim their prize.

Like the other scams in this campaign, the pages ultimately attempt to collect personal or payment information, often under the pretext of paying a small shipping fee or verifying eligibility.

Fake Dell Laptop Giveaway Survey

Another variation promotes a Dell laptop giveaway, typically claiming that users can win a Dell 16 DC16250 laptop worth $699.99.

Domains hosting these pages include:

avgeasyposttips[.]autos
searchonboardloadingrock[.]autos
alt-dig-gold-tab[.]autos
gold-avg-pe-nb[.]autos
tra4fficjumpchoiceclever[.]autos
digprtdreamavg[.]autos
shifttra4fficcapsmatch[.]autos
digitalshiftusbin[.]autos
spacevertabnb[.]autos
rot-digital-fly-f2f[.]autos

These pages typically:

  • Ask the victim to answer a few survey questions.
  • Display a congratulatory message.
  • Request credit card details to pay for shipping fees.

Fake “AI Data Assistant – Earn $500/day” Job Lure

Another theme used in this campaign promotes a fake online job opportunity, claiming users can earn $500 per day as an AI data assistant.

Observed domains:

verifieddreamseriesultimate[.]autos
pushbuttonsystem[.]net
lifeverifiedfavouritever[.]autos
mailanalyticsvolseries[.]autos
spacevertabnb[.]autos

These pages typically claim:

  • No experience required
  • High daily earnings
  • Work from home opportunities

Users are often redirected through several steps designed to collect personal information or push affiliate offers.

“Antivirus Subscription Expired” Phishing Pages

Another set of pages impersonates security alerts, claiming the user’s antivirus subscription has expired.

Domains observed:

safepremiumfreeriskfree[.]autos
nationalrecommendsafesmart[.]autos
deviceriskfreesafe[.]autos
freespeedpopular[.]autos
guardpopularinstalldevice[.]autos
speeddeviceboostfast[.]autos
programeffectivespeedfast[.]autos

These pages typically:

  • Display fake security warnings
  • Urge users to renew antivirus protection
  • Redirect victims to payment or affiliate pages.

“Cloud Storage Full” Phishing Pages

Another variation of this campaign uses cloud storage warnings, claiming the user’s storage account is full.

Observed domains:

stairs-table-fire.autos
tablewordstairs[.]autos
ceilwordinteriorbowl[.]autos
safe-premium-free-riskfree[.]autos
nationalprotectsmartfree[.]autos
guardpopularinstalldevice[.]autos
ceil-word-interior-bowl[.]autos
free-speed-popular-guard[.]autos
device-safe-clean-boost[.]autos
boost-premium-recommend-effective[.]autos
trk[.]independent-teacher-strength-nails[.]run

Additional domains were also shared by an X user quoting my earlier post:

These pages often mimic services such as:

  • Google Drive
  • iCloud

The goal is to scare victims into clicking through fake upgrade or security alerts.

Fake Walmart Survey Scam

Several phishing domains impersonate Walmart survey reward campaigns, often promising a free gift or prize in exchange for completing a short survey.

Domains observed:

jumpdiganalyticsprt[.]autos
avgeasyposttips[.]autos
cleververifieddigitalmatch[.]autos
altbio[.]autos
alt-dig-gold-tab[.]autos
matchstarsrotchoice[.]autos
directvolcapsus[.]autos
digprtdreamavg[.]autos

These pages typically display messages such as:

  • “Congratulations! You have been selected to receive a reward”
  • “Complete a short Walmart survey to claim your prize”

After the survey is completed, victims are usually asked to pay a small shipping fee, where credit card information is harvested.

Key Observation

One of the most notable aspects of this campaign is the central role of the Google Cloud Storage page:

storage[.]googleapis[.]com/whilewait/successcomes.html

During testing, this page was observed redirecting users to multiple phishing domains across different scam themes.

This suggests it is functioning as a traffic distribution or redirect infrastructure, allowing attackers to rotate phishing destinations while keeping the initial delivery URL stable.

Using Google Cloud Storage also adds a layer of trust, as the domain belongs to a legitimate cloud provider.

Another interesting observation is that a single .autos domain can serve multiple phishing page themes after redirection from the Google Cloud Storage page. Depending on the redirection path or parameters, the same domain may host different scams such as:

  • Fake surveys
  • Reward scams
  • Storage full alerts
  • Antivirus subscription warnings
  • Job offer lures

This behavior indicates that the attackers are likely using a shared phishing kit or centralized backend infrastructure, allowing them to quickly rotate scam themes while reusing the same domains.

Another observation is the high volume of phishing emails currently being distributed using this infrastructure. Over the past few days, I have been receiving around 40–50 phishing emails within a 24-hour period, many of which contain links to Google Cloud Storage pages that act as redirectors to the phishing ecosystem described in this report.

URLs repeatedly observed in these emails include:

storage[.]googleapis[.]com/whilewait/successcomes.html
storage[.]googleapis[.]com/savelinge/goforward.html

Indicators of Compromise (IOCs)

Google Cloud URLs

storage[.]googleapis[.]com/whilewait/successcomes.html
storage[.]googleapis[.]com/sndrr/strow.html
storage[.]googleapis[.]com/noonchi/noon.html
storage[.]googleapis[.]com/sndrr/hmd.html
storage[.]googleapis[.]com/wetaobao/taobao.html
storage[.]googleapis[.]com/savelinge/goforward.html
storage[.]googleapis[.]com/lithesome/stepupnow.html

Phishing Domains

digital-shift-us-bin[.]autos
searchonboardloadingrock[.]autos
mailanalyticsvolseries[.]autos
verifieddreamseriesultimate[.]autos
goldavgpenb[.]autos
alt-dig-gold-tab[.]autos
bio-easy-pe-loading[.]autos
analytics-mail-post-quite[.]autos
favouritebiochoicelife[.]autos
goldavgpenb[.]autos
alt-dig-gold-tab[.]autos
bio-easy-pe-loading[.]autos
analytics-mail-post-quite[.]autos
favouritebiochoicelife[.]autos
avgeasyposttips[.]autos
searchonboardloadingrock[.]autos
alt-dig-gold-tab[.]autos
gold-avg-pe-nb[.]autos
tra4fficjumpchoiceclever[.]autos
digprtdreamavg[.]autos
shifttra4fficcapsmatch[.]autos
digitalshiftusbin[.]autos
spacevertabnb[.]autos
rot-digital-fly-f2f[.]autos
verifieddreamseriesultimate[.]autos
pushbuttonsystem[.]net
lifeverifiedfavouritever[.]autos
mailanalyticsvolseries[.]autos
spacevertabnb[.]autos
safepremiumfreeriskfree[.]autos
nationalrecommendsafesmart[.]autos
deviceriskfreesafe[.]autos
freespeedpopular[.]autos
guardpopularinstalldevice[.]autos
speeddeviceboostfast[.]autos
programeffectivespeedfast[.]autos
stairs-table-fire.autos
tablewordstairs[.]autos
ceilwordinteriorbowl[.]autos
safe-premium-free-riskfree[.]autos
nationalprotectsmartfree[.]autos
guardpopularinstalldevice[.]autos
ceil-word-interior-bowl[.]autos
free-speed-popular-guard[.]autos
device-safe-clean-boost[.]autos
boost-premium-recommend-effective[.]autos
trk[.]independent-teacher-strength-nails[.]run
jumpdiganalyticsprt[.]autos
avgeasyposttips[.]autos
cleververifieddigitalmatch[.]autos
altbio[.]autos
alt-dig-gold-tab[.]autos
matchstarsrotchoice[.]autos
directvolcapsus[.]autos
digprtdreamavg[.]autos

This campaign demonstrates how attackers continue to abuse trusted cloud infrastructure such as Google Cloud Storage to host redirectors that distribute victims to multiple phishing pages.

By using legitimate cloud services as part of the attack chain, threat actors can increase credibility and reduce the likelihood of immediate blocking.

The use of large numbers of disposable .autos domains further allows attackers to rotate phishing pages frequently while keeping the delivery infrastructure intact.

In addition, the system appears to restrict repeated access attempts from the same IP address. After a user successfully reaches a phishing page through the redirector, subsequent attempts to access similar URLs from the same IP may result in the page failing to load or redirecting to unrelated sites. This behavior suggests the presence of IP-based filtering or traffic distribution logic, commonly used in malicious traffic distribution systems (TDS) to control how often a visitor can access the phishing infrastructure.