Over the previous few months, a large-scale cloud storage subscription rip-off marketing campaign has been concentrating on customers worldwide with repeated emails falsely warning recipients that their pictures, information, and accounts are about to be blocked or deleted as a consequence of an alleged cost failure.
Primarily based on quite a few emails seen by BleepingComputer, the marketing campaign has escalated over the previous few months, with individuals receiving a number of variations of the rip-off every day, all showing to be despatched by the identical scammers.
Whereas the e-mail textual content, the messages all try to create a way of urgency by claiming a cost drawback or storage challenge have to be resolved instantly, or individuals’s information can be deleted or blocked.
The cloud storage rip-off e mail marketing campaign
The phishing emails originate from a variety of domains, with most showing to be randomly generated for the spam marketing campaign, as proven within the pattern listing beneath.
xavpy@njyihuhzhyjumdjenwdsugjsku.us
hxsupportxf@bjmbsjabnjjvdfdlntduihco.com
zwblygwgtrmwag.18445435479309@qqjon7.oleglp.4mzrly.us
[name]-6704@ucv9q.333.sb100014.tour.za.comThe emails themselves use all kinds of topic traces, all designed to scare a recipient into opening the e-mail.
Instance topic traces seen by BleepingComputer embody:
- Speedy Motion Required. Cost Declined
- Cloud Storage 1TB: Cost overdue
- [personal name]¸Your Account Has been Blocked! Your Photographs and Movies can be Eliminated Fri,30 Jan-2026. take motion!!
- We have blocked your account! Your pictures and movies can be deleted . Renew your subscription totally free now!
- [personal name] – Your retailer is full , click on to verify and save 80% , ID#88839
- [personal name], Your Cloud Account has been locked on Mon,26 Jan-2026. Your pictures and movies can be eliminated!
- Sorry [<personal email address>], We Have To Droop Your Account At this time ! Sat,24 Jan-2026
- [name] – Your retailer is full , click on to verify and save 80%
- Cloud Storage 1TB: Cost overdue
Lots of the topic traces are personalised with the recipient’s identify or e mail tackle and embody particular dates or identifiers to extend urgency and make the messages seem legit.
The e-mail seen by BleepingComputer declare {that a} cloud subscription renewal failed or {that a} cost technique has expired, with recipients warned that backups might cease syncing and that pictures, movies, paperwork, and gadget backups may very well be misplaced if the difficulty isn’t resolved.
Supply: BleepingComputer
The emails seen by BleepingComputer declare {that a} cloud subscription renewal failed or {that a} cost technique has expired, and warn recipients that backups might cease syncing and that pictures, movies, paperwork, and gadget backups may very well be misplaced if the difficulty isn’t resolved.
The messages continuously embody made-up account IDs, subscription numbers, and expiration dates so as to add legitimacy.
“Your Cloud Subscription Is at Danger. We could not course of your most up-to-date cost. If not resolved, your Cloud storage and backups could also be paused,” reads an e mail seen by BleepingComputer.
“Speedy Motion Required Please confirm or replace your cost technique as quickly as potential to keep away from shedding entry to your pictures, information, and gadget backups.”
All spam emails on this marketing campaign contained a hyperlink to https://storage.googleapis.com/, which is a part of Google Cloud Storage, the place risk actors hosted static redirector HTML information. When a customer clicks this, the URL redirects them to a rip-off/phishing website hosted on random domains.
The entire hyperlinks examined by BleepingComputer result in the identical set of rip-off pages.
The phishing pages impersonate cloud service portals and prominently show cloud-themed branding, together with the Google Cloud brand. The net pages declare the person’s cloud storage is full and warn that pictures, movies, contacts, information, and personal knowledge are now not being backed up and can be deleted.
“Since you’ve exceeded your storage plan, your paperwork, contacts, and gadget knowledge are now not backing as much as Cloud and your pictures and movies are usually not importing to Cloud Photographs. Cloud Drive and Cloud-enabled apps are usually not updating throughout your gadgets,” reads the phishing website proven beneath.
“Your knowledge can be misplaced with out safety safety if no pressing motion is taken.”
Supply: BleepingComputer
Clicking on the “Proceed” button brings targets to a faux storage scan that at all times reviews that Photographs, Cloud Drive, and Mail are all full. The pages then warn that knowledge can be misplaced until the cloud storage is upgraded, claiming that the individual is eligible for a limited-time “loyalty” improve at an 80% low cost.
Nevertheless, after clicking the replace storage button, as an alternative of being taken to a legit cloud providers web page, you might be redirected to affiliate internet marketing pages selling unrelated merchandise.
Merchandise promoted on this phishing marketing campaign embody VPN providers, little-known safety software program, and different subscription-based choices with no connection to cloud storage.
The pages in the end result in checkout types designed to gather bank card particulars and generate affiliate income for the risk actors behind the marketing campaign.
Sadly, many individuals who obtain these emails might not notice they’re scams and buy a product they do not want, pondering it would resolve the faux cloud storage points.
You will need to perceive that these emails and touchdown pages are usually not legit cloud service notifications. Moreover, legit cloud suppliers don’t ship emails that result in storage scans or third-party safety or VPN merchandise to resolve billing points.
Moreover, most legit cloud storage suppliers will block entry to your extra storage whenever you fail to make a cost, slightly than deleting your information instantly.
For instance, Google says that if a Google Drive plan is canceled, you’ll lose entry to your extra storage till you make a cost once more, and your information will solely be deleted after 2 years.
Microsoft OneDrive follows an identical strategy however says it could delete information after 6 months if the account exceeds its allotted storage.
Customers who obtain these spam messages ought to delete them with out clicking any hyperlinks and never buy something promoted by way of the emails.
Because the marketing campaign’s objective is to scare recipients into pointless purchases, ignoring these messages is one of the best plan of action.
Any issues about cloud storage or billing ought to as an alternative be checked manually by visiting the official web site or app of the legit cloud service.
Fashionable IT infrastructure strikes sooner than handbook workflows can deal with.
On this new Tines information, find out how your crew can cut back hidden handbook delays, enhance reliability by way of automated response, and construct and scale clever workflows on high of instruments you already use.
