Cybersecurity researchers have observed an uptick in email phishing campaigns designed to deliver banking trojans to victims primarily in Latin America and Europe. Three (3) trojans in particular: Astaroth (Guildma), Mekotio, and Ousaban (Javali) are misusing Google’s Cloud Run service to distribute the malware. Google Cloud Run is a managed computing platform that enables customers to build and deploy webservices in Google Cloud. Threat actors are weaponizing Google Cloud Run due to its trusted nature; many organizations will not prevent internal systems from accessing Google platforms. Cybersecurity researchers have been tracking the rise of these phishing campaigns since the Fall of 2023. There are many commonalities between the malware families which all use the same storage bucket in Google Cloud for propagation and malicious Microsoft Installers (MSIs) as droppers for the final malware payload. The phishing campaigns appear to originate predominately from systems in Brazil using emails that are largely written in Spanish. The phishing emails sometimes purport to be from a local tax agency, and are likely to contain invoices, financial documents, or tax documents. The links included in the phishing email will direct to run[.]app, which delivers the ZIP archive containing a malicious MSI file to the victim. In some cases, researchers have observed redirects from the run[.]app site to legitimate sites like google[.]com to evade detection. The final banking trojan payload is designed to steal the victim’s credentials to financial institutions. The malware achieves this by tracking the victim’s web browsing activity, logging keystrokes, and taking screenshots of the victim’s device. CTIX analysts will continue to report on novel strains and new trends in malware campaigns.