Large-Scale Phishing Infrastructure Uncovered: 12,704 Servers Exploit Google Cloud and Scraped NYT Content A recent investigation has exposed a sophisticated, globally distributed phishing operation leveraging 12,704 internet-facing servers across 55 countries to facilitate spam and credential-harvesting campaigns. The infrastructure, designed for deliverability, evasion, and resilience, abuses Google Cloud Storage as an initial redirect layer before funneling targets to attacker-controlled landing pages many of which mimic The New York Times to deceive security scanners and non-targeted visitors. ### Key Findings - Scale & Distribution: The network spans 412 hosting providers, with the highest concentrations at HostPapa (630 servers), velia.net (453), OVH SAS (438), and Leaseweb (423). Geographic diversification including heavy use of low-cost VPS markets in Turkey and Romania complicates takedown efforts. - Google Cloud Abuse: Attackers exploit Google Cloud Storage to host benign-looking HTML/JS files, using trusted Google domains (e.g., `storage.googleapis.com`) to bypass initial suspicion. JavaScript redirects then obscure the final phishing destination, allowing operators to rotate infrastructure without updating embedded email links. - Deceptive Landing Pages: Servers serve near-identical pages scraped from The New York Times, likely to evade detection by security tools. Only targeted visitors identified via factors like location, browser type, or referral source are redirected to malicious payloads. - Outdated & Vulnerable Software: 99.8% of servers run end-of-life (EOL) software, including: - Apache/2.4.52 (Ubuntu): 69% - Apache/2.4.6 (CentOS) with OpenSSL/1.0.2k-fips: 21% - Apache/2.4.41 (Ubuntu): 6% - Apache/2.4.58 (Ubuntu): 4% The uniformity suggests automated deployment from a small set of server images. - Low Abuse History: 89% of IP addresses had no prior reports in AbuseIPDB, indicating either rapid rotation or use as intermediate redirectors to avoid reputation-based blocking. - Selective Targeting: The infrastructure appears to filter visitors, serving benign content to scanners while delivering phishing pages to intended victims. The exact filtering logic remains unclear. ### Operational Tactics 1. Initial Contact: Victims receive spam emails with links to Google Cloud Storage URLs, which appear legitimate. 2. First Redirect: JavaScript on the Google-hosted page redirects to an attacker-controlled server. 3. Landing Page: Non-targets see NYT-scraped content; targets are sent to phishing pages. 4. Credential Harvesting: Victims who enter personal or financial data have their information compromised. ### Impact & Unknowns While the investigation confirms the existence and scale of the infrastructure, critical details remain unknown: - Total email volume sent via this network. - Number of victims who clicked links or submitted data. - Identity of the operators, though the coordinated deployment and shared tooling suggest a centralized operation rather than isolated actors. The campaign’s design distributed hosting, EOL software, and Google Cloud abuse prioritizes persistence and evasion, making disruption difficult. Victims who entered credentials on any linked page should assume their data is compromised. Even clicking a link may confirm an email address as active, increasing future spam exposure.