{"success":true,"data":{"id":"fake-aws-cloud-billing-overage-phish","label":"Fake AWS, Azure, or cloud platform billing failure or overage phishing — fraudulent email impersonating Amazon Web Services, Microsoft Azure, Google Cloud, or similar cloud provider claiming the recipient's payment has failed, account will be suspended, or has an unexpected usage charge — directing them to click a link to update payment details, confirm billing information, or verify their credit card to restore services — a high-value phishing attack targeting developers and businesses dependent on cloud infrastructure","description":"Phishing emails impersonating Amazon Web Services, Microsoft Azure, Google Cloud Platform, DigitalOcean, or other cloud providers — claiming the recipient's cloud account payment has failed, their account will be suspended or terminated, they have an unexpected usage overage charge, or their billing is past due — then directing them to click a link to update payment details, confirm billing information, or verify their credit card to restore services. Cloud billing phishing is particularly high-value because cloud accounts may control critical business infrastructure. Key facts: (1) Cloud account phishing is one of the highest-impact categories by damage potential — a compromised AWS account has been used to spin up thousands of GPU instances for cryptomining ($50,000–$500,000 charges in hours), launch spam/phishing infrastructure, exfiltrate sensitive data from S3 buckets, and conduct lateral movement into connected corporate systems; (2) AWS, Azure, and GCP are all in the top-20 most impersonated brands in business-targeted phishing — credential harvesting for cloud accounts is a primary objective of nation-state and organized cybercrime groups, not just opportunistic scammers; (3) The billing failure lure exploits a real anxiety point — cloud developers and DevOps engineers are acutely aware that billing issues can take down production systems; the \"account suspension\" threat creates genuine urgency that bypasses normal skepticism; (4) Legitimate AWS, Azure, and GCP billing alerts always link to official console pages (console.aws.amazon.com, portal.azure.com, console.cloud.google.com) and are accessible within the authenticated console — never via external email links requesting card details. Warning signs: non-official cloud provider domain, billing failure or suspension urgency with external payment link, credit card or bank account details requested via email.","tier":"danger","category":"phishing","isThin":false}}