Inside the 'Google Trusted Sender' Cloud Storage Phishing Toolkit

Since January 2026, one operator and seven sub-operators have run a shared phishing toolkit staging first-stage redirectors on Google Cloud Storage. Every message opens with the same social-engineering flourish, a literal Google© - This message was sent from a trusted sender. line pasted at the top of the body to imitate Gmail's verified-sender UX. Behind that badge sits a single kit: burner sending domains that pass SPF, DKIM, and DMARC; click-through links that always land on storage.googleapis[.]com; and a first-stage page that uses a URL fragment to bounce the victim onward to the real credential or payment trap. We tracked the operation across casino, sweepstakes, lawsuit lead-gen, real-estate, and fake-government verticals, and watched a stratum of smaller sub-operators buy into the same kit.

Key Takeaways

• A shared Google Cloud Storage redirector kit powers a multi-vertical phishing operation: one primary operator plus seven distinct sub-operators, active since January 2026.
• Every click-through terminates on storage.googleapis[.]com, where a minimal first-stage page reads a URL hash fragment and redirects the live browser onward, so a server-side crawler only ever sees a trusted Google URL.
• Sending infrastructure is auth-compliant by design. The burners pass SPF, DKIM, and DMARC, which removes envelope authentication as a distinguishing signal.
• Three sender-naming families and six return-path impersonation families are stable fingerprints that survive the constant churn of individual domains.
• Registration data splits cleanly into an aged Namecheap stash reused for return-path apexes and purpose-built 2026 Spaceship and Dynadot .biz bursts registered in same-day batches.

Background

The operation surfaced through a body-content signature rather than an infrastructure hit. A cluster of emails opened with the exact string Google© - This message was sent from a trusted sender., copyright symbol included, positioned to mimic the trust cues Gmail renders for verified senders. That phrasing does not appear in legitimate mail, which made it a clean pivot into the wider toolkit.

The badge is only one dialect. The same Google Cloud Storage buckets carry tens of thousands of phishing emails using other body language, so the trust-badge cohort is a narrow slice of a much larger operation. What binds the slices together is not the wording but the plumbing underneath.

Google Cloud Storage serves arbitrary user-uploaded objects, including HTML, from Google's own trusted parent domain under a valid Google TLS certificate. A landing URL on storage.googleapis[.]com inherits Google's brand reputation and sails past casual domain-reputation and certificate checks. Buckets are cheap, provision instantly, and are disposable, which suits a burn-and-rotate model where each named bucket hosts a short-lived page and is abandoned before blocklists catch up. The operator stays exclusive to this host and never spills onto sibling clouds.

Discovery and Infrastructure

Mapping the operation meant pivoting on infrastructure, not on senders. The individual sending addresses share almost no from-domains with each other, so sibling-of-a-sender expansion goes nowhere. The click-through host and the bucket layer are the constants.

Every message routes its call to action through storage.googleapis[.]com/<bucket>/<file>.html, followed by a # fragment. The bucket names cluster into recognizable families (more on the naming grammar below), and more than 80 distinct buckets were active within a single five-day window. The sending side burns through single-use domains fast enough to produce hundreds of one-shot sender addresses across the campaign, with more than 150 of them in our verified indicator subset alone.

Layer	Role	Notes
storage.googleapis[.]com	First-stage host	Google Cloud Storage object hosting, abused as a trusted redirector staging point for 100 percent of the observed call-to-action links.
Named buckets	Landing storage	More than 80 active in one five-day window; naming clusters into transliteration, keyboard-mash, themed, and hex or base32 families.
Burner sending domains	Delivery	Single-use, auth-compliant (SPF, DKIM, DMARC all pass), spread across .us, .com, .net, .biz, .info, .my.id, and other low-cost TLDs.
Return-path apexes	Bounce routing	Multi-label impersonation strings that never appear in the visible From line.
i.imgur[.]com/kLAZGN8[.]png	Shared asset	Byte-identical image across casino variants, tying those clusters to one operator.

How It Works

A representative chain runs like this. A burner domain, registered days or weeks earlier with full SPF, DKIM, and DMARC records, sends an email whose body opens with the Google trust badge. The message carries a themed lure (a casino bonus, a payment notification, a government disbursement) and one or more call-to-action buttons. Casino-variant emails repeat the same button nine times, each pointing at a slightly different hash fragment.

Each button targets a URL of the form http[:]//storage.googleapis[.]com/<bucket>/<page>.html#<fragment>. The hosted page is a small block of JavaScript that reads location.hash and redirects the live browser to the final phishing destination encoded in the fragment. Everything after the # is the fragment identifier, which by web specification is never sent to the server. An automated scanner that fetches the URL server-side sees only the benign, trusted Google object; the real target is never fetched.

The call-to-action carries a per-victim tracking token, a hex od= parameter that decodes to a structured campaign identifier, a victim-state flag, a victim identifier, and a hit counter. That structure implies a managed victim database, consistent with lists sourced from a prior breach. Some lures reinforce the effect by injecting a leaked handle into the subject line and display name to manufacture familiarity.

Bounce handling is where the operator gets creative. The visible From domain is a plain burner, but the Return-Path carries a multi-label impersonation string designed to launder reputation or imply endorsement: a compromised GoDaddy Smartermail host with a real small-business domain buried as a middle label, a fake auth.email-secure[.]us authority label, or a fake federal label such as commerce[.]gov or mail-hub[.]gov stuffed ahead of the attacker apex (the true federal endpoints end in .gov; these end in .com or .co.in).

Sample Lures

The samples below are real messages with all recipient data removed. Sender domains are defanged. Attacker-side content only.

Casino bonus, the longest-running variant:

From: "Casino-Extreme" <actor@hvvi.hepfqfbpoekmg[.]us>
Subject: Casino Extreme's NGR Bonus - It's Time to Cash In!
Return-Path: <return@hss2719.secureserver.[compromised-domain].wednessed[.]com>
Body opens: Google© - This message was sent from a trusted sender.
CTA: http[:]//storage.googleapis[.]com/soumayabelarabi/lhbib.html#<fragment>/?<hex-tracking>

Payment notification, using Unicode bold-math glyphs to dodge plain-text keyword filters:

From: "CashApp" <actor@ykwuscngxysdtwjawduyljgs[.]com>
Subject: 𝗬𝗼𝘂 𝗿𝗲𝗰𝗲𝗶𝘃𝗲𝗱 𝗮 𝗽𝗮𝘆𝗺𝗲𝗻𝘁 𝗼𝗳 $7,000.00 USD
Return-Path: <return@[label].auth.email-secure[.]us.examinand[.]com>
CTA: http[:]//storage.googleapis[.]com/gjhgj/deamonwhite.html#/deamon.html?od=<victim-token>

Personalized-handle account lure, routed through a fake federal return-path:

From: "[recipient handle]" <actor@yuk4y9uk8yuk94uku-sender-domain>
Subject: Please Check Your account
Return-Path: <abuse@monitoring-system.monitoring.commerce[.]gov.fatiguangway[.]co[.]in>
CTA: http[:]//storage.googleapis[.]com/yuk4y9uk8yuk94uku/zigzag.html#/redirect.html?syw=<victim-token>

Fake-government disbursement, a current-events pretext from the fake-Treasury sub-operator:

From: "U.S. Disbursement Office" <actor@bookedsolidhq[.]com>
Subject: 2026 Emergency Supply Chain Act - Conflict Impact Compensation
Body marker (template leak): {{rand_num_8}}
CTA: http[:]//storage.googleapis[.]com/chahirt/aldossier/idddossier/Idddddddd.html#<fragment>

That last sample shows an unrendered Mustache or Handlebars template tag, {{rand_num_8}}, that leaked to the wire when the kit failed to populate it. Legitimate marketing automation does not ship raw template syntax, so the artifact both fingerprints the upstream kit and gives defenders a zero-noise content signal.

Technical Analysis

Sender Infrastructure Taxonomy

The sending side resolves into three primary naming families plus a set of secondary shapes. The families are stable even as the individual domains churn, which makes them the durable fingerprints.

The casino baseline family is the largest. It uses short .us labels and 16-to-24-character hex .com and .net labels, in several sub-shapes: triple-subdomain .us with a victim hex string in the local part (misaaulizgqfkl.87693842685445@71p1dp[.]87w0om[.]mnlwfv[.]us), two-label .us (giyuwckmnin@azxk[.]jcpercnpcyrvy[.]us), self-named short .us where the local part equals the domain label (aqr9axgeakta39igw3@aqr9axgeakta39igw3[.]us, tied to Walmart gift-card lures), and single-label 24-character .com or .net. A recurring twist inside this family is a support-suffix local part on the long .com domains: bvsupportert@, pqqcsupportjg@, alsupporteegs@, and half a dozen siblings.

The questionprov family uses a numbered apex, questionprov<N>.com or questionprov-<N>.com, with a 5-to-8-digit numeric suffix. Two local-part templates dominate: alert_<N>@ and teamsupport-<N>@.

The third family is subdomain-stuffing that embeds google as a sublabel inside a made-up apex, format <label>@<label>.google.<coined-apex>.<tld>. This family routes exclusively to two buckets and carries a UnitedHealthcare and Oral-B reward lure.

Sender family	Shape	Example (defanged)
Casino baseline	short/hex .us .com .net, several sub-shapes	pjbyakwhqcz@hvvi.hepfqfbpoekmg[.]us
Casino baseline (support-suffix)	<x>support<xx>@<24hex>[.]com	bvsupportert@ykwuscngxysdtwjawduyljgs[.]com
questionprov numbered	alert_<N>@questionprov-<N>[.]com	alert_22562599@questionprov-22562599[.]com
google-sublabel	<x>@<y>.google.<apex>.<tld>	bmkfxjc@pcrymimn[.]google[.]arxivobridge[.]com[.]tr
info triple-subdomain (sub-operator)	info@<22hex>.<22hex>.<22hex>.com	novel shape used by the Shadow Monarch sub-operator

Domain-Generation Grammar

The google-sublabel family draws its apexes from a coined pseudo-tech vocabulary: consonant-heavy invented stems loaded with x, z, q, and v (xelvora, lumerix, merqon, virex, rynex, nelix, trevox, noryx, zorex, zulvex, prymax, novixa) bolted to a generic SaaS or consultancy suffix (-research, -technology, -labs, -node, -vision, -launch, -pulse, -core, -beacon, -insight). The result reads like a plausible business name that matches no real brand, which is what lets it pass a casual eyeball test.

The bucket names follow their own families. A transliteration-and-elongation family carries Moroccan and Arabic given names, sometimes stretched with repeated vowels (soumayabelarabi, salmonnais, souuuummmyyya, sooooommmmaaaaaa). A keyboard-mash family looks like a hand dragged across the home row (compitarrari, vcxbiuouioui, dqsdqdqsdq, rrrrrrrrrrrrrrrrr). A themed family recurs across expansions (deamonblackfry, daemonblackfry, deamondevil). The newest and fastest-growing family is hex or base32 (fpzmeby4k85aitpz, 2io1upuza2hbewny, ecp7q2bw0z55xl8x), consistent with automated bucket generation.

Registration Cohorts

WHOIS data splits the operator's domains into two clean strata. An aged stash, almost all registered through Namecheap between 2023 and 2025, supplies the return-path apex family. A purpose-built 2026 cohort, registered through Spaceship and Dynadot on .biz, supplies the google-sublabel family, alongside a .com.tr batch and a large mass of no-WHOIS burners on .us, .info, .my.id, .biz.id, and questionprov*.com.

Registrar	Years	Domains	TLD / shape	Cohort role
Namecheap	2023-2025	11	aged .com .net .me .nl	Return-path apexes
Spaceship	2026	13	.biz	Purpose-built google-sublabel burst
Dynadot	2026	6	.biz	Purpose-built google-sublabel burst
Porkbun / Sav	2026	3	.biz	2026 burst
(no registrar)	2026	4	.com.tr	google-sublabel apexes
No-WHOIS burners	n/a	dozens	.us .info .my.id .biz.id questionprov*.com	Burner mass

The purpose-built cohort registers in same-day batches, a strong tell for automated bulk registration: four Spaceship .biz domains on 2026-02-21, three more on 2026-02-17, and three Dynadot .biz domains on 2026-04-25. Cheap gTLDs and ccTLDs are chosen because they are inexpensive, carry thin or absent public WHOIS, and are underrepresented in reputation feeds relative to .com, so a fresh domain on them arrives with less accumulated negative signal.

Return-Path Impersonation and Cross-Cluster Pivots

The return-path is the operator's laundering layer. Six families recur, each with a distinct impersonation trick and a fairly stable affinity to a vertical or sub-operator.

Return-path family (defanged)	Impersonation trick	Vertical / lure	Cluster
hss2719.secureserver.<compromised>.<apex>	GoDaddy Smartermail host plus compromised SMB middle-label	Casino bonus	Primary operator
<label>.auth.email-secure[.]us.<apex>	Fake authentication authority label	CashApp, personalized-handle	Primary operator
<label>.commerce[.]gov.<apex> / mail-hub[.]gov.<apex>	Fake US-federal labels (true endpoints end .gov)	Account check, fake disbursement	Primary op plus fake-gov sub-op
oversightboard.net.<apex>	Fake oversight authority label	Netflix, casino	Primary operator
lachute-kkahf.retoure.adicon.<apex>	Nonsense multi-label returns chain	Bank check, veteran benefits	Micro sub-operators
kanyewest-aminem.jay-z.lildurk.<apex>	Celebrity-name label chain	Real-estate, mixed	Sub-operator

Four independent ties bind the verticals to one primary operator. The per-victim od= hex token uses an identical format across all three sender families and across casino, lawsuit, and prize lures. The six return-path families recur across clusters. The bucket pool is shared, with buckets like pegasusbusmai, salmonnais, and daemonblackfry each carrying casino, prize, and lawsuit mail in the same window. And the i.imgur[.]com/kLAZGN8[.]png asset is byte-identical across the casino variants. A separate operator on content-storage.googleapis[.]com was explicitly ruled out of this toolkit, which is a useful reminder that not every Google Cloud Storage abuse pattern belongs to the same actor.

Detection Observations

The signals that separate this traffic from legitimate mail are structural, and they hold up better than any single domain.

• The literal Google© trust-badge opener is a narrow but high-fidelity content marker. It does not occur in legitimate mail, and it survives across the operator's domain churn.
• Envelope authentication is not a useful discriminator here. The burners pass SPF, DKIM, and DMARC, so an all-pass result carries no reassurance for this class of sender.
• The call-to-action host is a constant. Every link lands on one trusted cloud-storage host and hides the real destination in a hash fragment, so URL inspection that stops at the visible host learns nothing.
• Return-path strings are structurally anomalous. Multi-label chains that stuff commerce[.]gov, auth.email-secure[.]us, or a GoDaddy Smartermail host ahead of an unrelated apex do not resemble the return-path of the brand being imitated.
• Sender shape is high-precision. The questionprov<N>.com numbered pattern, the google-sublabel pattern, and the triple-subdomain .us shape each match the operator with little collateral.
• Content artifacts leak. Unicode bold-math glyphs in subject lines and unrendered {{rand_num_8}} template tags in bodies are both signals a defender can key on with near-zero noise.

Indicators of Compromise

All indicators are defanged and are a curated, verified subset of the operator's infrastructure. The verified sets are floors, not totals, because observed inventory understates what the operator actually holds.

Sender Addresses

Value	Role
pjbyakwhqcz@hvvi.hepfqfbpoekmg[.]us	Sender (casino baseline)
misaaulizgqfkl.87693842685445@71p1dp[.]87w0om[.]mnlwfv[.]us	Sender (victim-hex triple-subdomain)
bvsupportert@ykwuscngxysdtwjawduyljgs[.]com	Sender (support-suffix)
mgzres@molzvugzeczagestaomrrizvlk[.]net	Sender (24-char single-label)
alert_22562599@questionprov-22562599[.]com	Sender (questionprov)
teamsupport-89475590715381@questionprov167845[.]com	Sender (questionprov)
bmkfxjc@pcrymimn[.]google[.]arxivobridge[.]com[.]tr	Sender (google-sublabel)
epkebyc@sxfrodsd[.]google[.]lorixpulse[.]my[.]id	Sender (google-sublabel)
aqr9axgeakta39igw3@aqr9axgeakta39igw3[.]us	Sender (self-named, Walmart lure)
info@ekv2tb8sbb2k2hwe8j[.]com	Sender (telecom-prize sub-operator)
7hg8p@36w26y[.]com	Sender (short-apex sub-operator)
nooreply@8018005362283[.]gzfvxaydvcuajdtrry[.]org[.]uk	Sender (Costco reward)
... (representative subset; 150+ verified-malicious sender addresses)

Sending Domains

Value	Role
hvvi.hepfqfbpoekmg[.]us	Sending domain
71p1dp.87w0om.mnlwfv[.]us	Sending domain
ykwuscngxysdtwjawduyljgs[.]com	Sending domain
molzvugzeczagestaomrrizvlk[.]net	Sending domain
kgsmuizoaximddgczclvuazc[.]com	Sending domain
jyykanukpcbbfzgulpwlbdhj[.]com	Sending domain
gzhu.mktmkohkndejx[.]us	Sending domain
c7rlny.trnwla.ya11g0[.]us	Sending domain
fsbbwo[.]us	Sending domain (6-char)
npfxxa[.]us	Sending domain (6-char)
vtbbfeohmcvwwksgljvwcciq[.]com	Sending domain
ddaguimclmjrrbooushfayap[.]com	Sending domain
... (representative subset; 100+ verified-malicious sending domains)

Operator and Return-Path Domains

Value	Role
questionprov-22562599[.]com	Operator apex (questionprov)
questionprov508544[.]com	Operator apex (questionprov)
google547204[.]com	Operator apex (google-label burner)
google90438[.]com	Operator apex (google-label burner)
rynexvision[.]biz	Operator apex (google-sublabel)
lumerixzenith[.]biz	Operator apex (google-sublabel)
merqonlabs[.]biz	Operator apex (google-sublabel)
virexlaunch[.]biz	Operator apex (google-sublabel)
nelixnode[.]biz	Operator apex (google-sublabel)
xelvoratechnology[.]com[.]tr	Operator apex (google-sublabel)
arxivobridge[.]com[.]tr	Operator apex (google-sublabel)
15minutos[.]net	Return-path apex (aged stash)
scarpental[.]me	Return-path apex (aged stash)
dreamblazex[.]nl	Return-path apex (aged stash)
additioning[.]net	Return-path apex (micro sub-operator)
... (representative subset; 200+ verified-malicious operator domains)

Return-Path Apex Hosts

Value	Role
anthrough[.]net	Return-path apex
bokassassembly[.]net	Return-path apex
fatiguangway[.]co[.]in	Return-path apex (fake-federal)
headquartoonjpn[.]com	Return-path apex
howevertifices[.]com	Return-path apex
recompanyika[.]com	Return-path apex
json.odhlasit-odber[.]com	Return-path host (sub-operator)
15minutos[.]net	Return-path apex
dreamblazex[.]nl	Return-path apex

MITRE Fight Fraud Framework Mapping

The behaviors align to the MITRE Fight Fraud Framework (F3) (https://ctid.mitre.org/fraud). Tactics and techniques below use the Fraud-matrix vocabulary.

Tactic	Observed behavior	Campaign behavior
Resource Development	Acquire infrastructure	Bulk-registered burner domains in same-day batches; disposable Google Cloud Storage buckets
Resource Development	Compromise accounts	Compromised GoDaddy Smartermail hosting and a compromised university mailbox used for reply routing
Initial Access	Phishing message	Brand-impersonation email with a spoofed trust-badge opener
Initial Access	Impersonate trusted entity	Fake Google verified-sender badge; impersonated brands and federal agencies in display names and return-paths
Execution	Elicit credentials or payment	Hash-fragment redirect to a credential or payment page keyed to a per-victim token
Stealth	Obscure infrastructure	Hash-fragment redirector that hides the real destination from server-side scanners; return-path label stuffing

Conclusion

The individual domains in this operation are disposable and will keep rotating, but the kit underneath is not. The structural fingerprints (three sender families, six return-path impersonation patterns, a shared per-victim token format, and exclusive use of one trusted cloud host as a fragment-based redirector) are what persist across expansions and across the sub-operators renting the kit. Defenders who anchor on those patterns, rather than on any single domain or bucket, will stay ahead of the churn. The trust-badge wording is a gift while it lasts; the plumbing is the durable target.