Fake malware hosted directly on GOOGLEs servers - no problem.
The Call is Coming from Inside the House: When Alphabet Becomes the Malware CDN
Let’s take a moment to marvel at the sheer, unparalleled cybersecurity juggernaut that is Alphabet.
Here is a company with effectively infinite resources. They own Google Safe Browsing, the very shield that protects billions of users from the dark corners of the web. They own VirusTotal, the world’s premier malware scanning and threat intelligence database. They even dropped $5.4 billion to acquire Mandiant, basically buying the Avengers of incident response. Add in planetary-scale telemetry, and you’d think their own backyard would be the safest place on the internet, right?
Wrong.
Instead, threat actors are comfortably kicking back and using Google Cloud Storage as their personal, high-speed, highly reliable Content Delivery Network for malware.
Case in point: A wildly obvious Gate.io phishing clone. The cybercriminals didn't even have to work hard to find bulletproof hosting. They just spun up a bucket on Google's infrastructure and hosted their malicious payload directly at https://storage.googleapis[.]com/aicoin/Gate-x64.zip.
Let that sink in. The company that scans your Gmail for suspicious attachments, flags dodgy domains in Chrome, and literally owns the platform where the entire infosec industry uploads malware samples to be analyzed... is actively hosting the malware. It’s sitting right there on their own premises.
The payload itself isn't even trying to hide. Run it through a sandbox, and it lights up like a Christmas tree: persistence mechanisms, dropped DLLs, location checks—the whole nine yards of a classic crypto-stealing or remote access trojan setup.
It is profoundly unacceptable that a tech empire with billions of dollars and the world’s most advanced threat-hunting capabilities can't seem to police its own basic storage buckets. We are constantly lectured by big tech about "zero trust" and "advanced persistent threats," yet they can't even stop a generic phishing campaign from using their own domains to bypass security filters. (Because hey, who blocks googleapis.com, right?)
So, a slow clap for Google, Mandiant, and the whole Alphabet security apparatus. It’s truly incredible to own the world's most sophisticated burglar alarms while simultaneously leaving the front door wide open and offering the burglars a free storage unit in the garage.