A global phishing operation is running at scale by borrowing credibility from two places at once: Google's free cloud infrastructure and the editorial output of legitimate news publishers.
Researchers tracking the campaign found it spread across thousands of coordinated servers. Every outbound link routes through Google Cloud, whose domains carry enough trust reputation that most corporate filters pass them without scrutiny. The emails embed scraped text from real news sources, including the New York Times, giving automated content scanners something genuine-looking to read. The scanner sees journalism; the reader gets phishing.
The technique exposes a structural problem with reputation-based filtering. You cannot blacklist Google's infrastructure without enormous false-positive rates, and no classifier reliably separates scraped news copy from legitimate content sharing. The attackers are exploiting the exact trust signals that make security tools fast enough to actually use.
Trusted-platform phishing is not new; Microsoft's Azure and SharePoint links have turned up in similar campaigns for years. What stands out here is the content layer. Padding emails with stolen editorial copy is a more sophisticated evolution of an old trick — hiding random dictionary words to confuse Bayesian filters — except the payload is now indistinguishable from a newsletter forward. There is no clean fix, because the signals being abused are genuinely good ones.