61/69 Monday, February 2, 2026
A large-scale phishing campaign is currently spreading worldwide, targeting users of cloud storage services. Cybercriminals send fraudulent notification emails claiming that monthly payments have failed or that storage space is full, creating panic by warning that photos and important files will be deleted or access will be suspended within a limited time. Investigations have found that the attackers often include the victim’s real name and email address in the subject line to increase credibility, while using large numbers of randomly generated sender domains to evade spam filtering systems.
The attackers’ tactic involves embedding links that lead to fake websites designed to closely resemble legitimate service provider portals. These pages often abuse Google Cloud Storage to host redirect pages as a form of camouflage. Once victims click the link, the site displays a fake storage scan showing that the account is full, followed by an offer of discounts of up to 80% to entice users to upgrade. Ultimately, victims are redirected to a fraudulent payment page designed to steal credit card details, or to unrelated subscriptions such as VPN services or unlicensed software, generating affiliate revenue for the attackers.
Security experts advise users to remain cautious and avoid clicking links in emails that urgently demand immediate payment. In reality, major cloud providers do not instantly delete user data when payment issues occur; instead, they typically impose limited restrictions and provide long grace periods, sometimes lasting months or even years (for example, Google may retain data for up to two years, while OneDrive allows up to six months). If there are concerns about an account’s status, users should check directly through the official website or application of the service provider and delete suspicious emails immediately to reduce risk.