Return-Path: Delivered-To: alvarochf@traceseis.com Received: from cs510.bluehost.com by cs510.bluehost.com with LMTP id +GnOEEQ432ndsQsAWiBQxw (envelope-from ) for ; Wed, 15 Apr 2026 01:03:32 -0600 Return-path: Envelope-to: alvarochf@traceseis.com Delivery-date: Wed, 15 Apr 2026 01:03:32 -0600 Received: from mail024.mlsend.com ([185.225.161.24]:21953) by cs510.bluehost.com with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2) (envelope-from ) id 1wCuHb-00000003GGe-2A8i for alvarochf@traceseis.com; Wed, 15 Apr 2026 01:03:32 -0600 DKIM-Signature: a=rsa-sha256; bh=iJBnlIiEuKNtxH6PpjnWnW/hW0bp4WQTJrgmctdJfi8=; c=relaxed/relaxed; d=mail.any.run; h=DKIM-Signature:X-Mailer-Info:Subject:From:To:Date:Received:Message-ID:x-mailer-recipientid:Feedback-ID:List-Unsubscribe-Post:List-Unsubscribe:Precedence:X-Mailru-Msgtype:X-CampaignID:Reply-To:MIME-Version:Content-Type; s=litesrv; t=1776236595; v=1; b=VyE4HyvScD4QAtWZlHY8wxy+XSZjOdCxTTFQ97vKdfwLupAASrnKdD8iiAaikKSWkCPgdZXU F9f2UzKyRWn0qTqoW9E0iaY2DKE5c5MjHyC5+7/9MJl35x2F2eLK+9k7DNqVtYo8+TyzXakHbs4 jnXlpgX+c4Fr1ac8/mww/owI= DKIM-Signature: a=rsa-sha256; bh=iJBnlIiEuKNtxH6PpjnWnW/hW0bp4WQTJrgmctdJfi8=; c=relaxed/relaxed; d=mlsend.com; h=X-Mailer-Info:Subject:From:To:Date:Received:Message-ID:x-mailer-recipientid:Feedback-ID:List-Unsubscribe-Post:List-Unsubscribe:Precedence:X-Mailru-Msgtype:X-CampaignID:Reply-To:MIME-Version:Content-Type; s=litesrv; t=1776236595; v=1; b=lIQL7SaUvCnIpASN5wOD0iKXsuSi3PB6eKacLj4QnCObLXhz6denncWtyPLrenrYIwUqyHx1 NJ25/ZylUO++QtZoYjrQ9D5NVtAxnuJvCKqOOb1ubiMG36oh87wzAwixH9PUfbEYiZXCcDwoDDO rQ0cEXfZy92YGIXNYh24lZf4= X-Mailer-Info: 10.MWYtBXYpdmb.MWYtBXYpdmbxgDN3ETO5kTOxcTMwMzNxUzM.EGb2FmcvNGa mBEdyF2YlNXZpNnLj9Wb.QM4QzNzEzN0QTOwkzM5UTOyUTY0EzN3YDN.... Subject: Alvaro, Detect Early: Remcos RAT via Google Storage From: "The ANY.RUN Analyst Team" To: Alvaro Date: 15 Apr 2026 07:03:15 -0000 Received: from 10.36.17.67 by 10.164.0.44 with http; 15 Apr 2026 07:03:15 +0000 Message-ID: <184731744909395925a417764@mlsend.com> x-mailer-recipientid: 184731744909395925a417764 Feedback-ID: campaign184719999147968480:417764:campaign:MailerLite List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Precedence: bulk X-Mailru-Msgtype: 184731744909395925 X-CampaignID: 184719999171037153 Reply-To: "The ANY.RUN Analyst Team" MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="==ccaffeb542a488fe6c2957fbdbd78d30" X-Spam-Status: No, score=0.5 X-Spam-Score: 5 X-Spam-Bar: / X-Spam-Flag: NO This is a multi-part message in MIME format. --==ccaffeb542a488fe6c2957fbdbd78d30 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hello, You have received a newsletter from ANY. RUN. However, your email software can't display HTML emails. You can view the= newsletter by clicking here: https://letter.mail.any.run/emails/webview/417764/184731744909395925 You're receiving this newsletter because you have shown interest in ANY.= RUN. Not interested anymore? Click here to unsubscribe: https://letter.mail.any.run/unsubscribe/417764/184731744909395925?signat= ure=3Dcdf55c59ae56d1f5213b541048756df774026a3adeeb24fba7d9439cfab97247 --==ccaffeb542a488fe6c2957fbdbd78d30 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable =20 =20 Alvaro, Detect Early: Remcos RAT via Google Storage =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20
=20 =20 =20 =20 =20
 Active phishing bypasses reputatio= n checks & delivers Remcos RAT in-memory. Analyze it now + collect I= OCs
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20
=20 =20 =20
=20 =20
3D"ANY.RUN"
=20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

De= tect Early: Phishing via Google Cloud Storage

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20 =20 =20
=20 =20
=20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Hi Alvaro!<= /h1>

We've recent= ly identified an active phishing campaign abusing Google Cloud S= torage to bypass email filters and reputation checks. The = campaign hosts HTML phishing pages to deliver the Remcos RAT.

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20

=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20
=20 =20 =20 =20 =20
=20
Full technical breakdown
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Here=E2=80=99s a sho= rt overview of the attack chain:

  • Atta= ckers are hosting HTML phishing pages themed as Google Drive document vi= ewers. 
  • The pages mimic Google Workspace sign-in prompts wi= th a specific lure: =E2=80=9CSign in to view document in Google Drive.=E2= =80=9D
  • After =E2=80=9Csuccessful login=E2=80=9D the page leads t= o download of a file that initiates the malware delivery.
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20 =20 =20 =20 =20
=20

= Real danger: Remcos RAT runs in memory inside a trusted= process, remains undetected for weeks or months, and silently harvests = sensitive data. Reveal Remcos samples =E2=86= =92
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

Catch threats before= they become incidents

Get a con= tinuous stream of 99% unique, verified malicious indicators= delivered into your SIEM, SOAR, TIP, or XDR via STIX/TAXII or = API/SDK integrations.

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20
=20 =20 =20 =20 =20
=20
Get TI Feeds
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

More threat reads fo= r you:

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20
=20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20 =20
=20

Stay safe= and keep hunting,
The ANY.RUN team

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20
=20
=20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20

ANY.R= UN

Dubai Silicon= Oasis, Techno Hub 1,
Unit 21, 60th Street, 342001, UAE

=
=20
3D"linkedin" 3D"x" 3D"youtube" 3D"reddit" 3D"discord"
=20

Privacy & Terms | Send Feedback
For any queries: support@a= ny.run

You received this email because 
you signed up for= our newsletter

Unsubscribe =20 =20 =20

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
<= /td>
=20 =20 =20 =20 =20
=20 =20 =20
=20 =20 --==ccaffeb542a488fe6c2957fbdbd78d30--