A large-scale cloud storage subscription scam campaign has been targeting users worldwide with repeated emails falsely warning recipients that their photos, files, and accounts are about to be blocked or deleted due to an alleged payment failure. The campaign has escalated over the past few months, with people receiving multiple versions of the scam each day, all appearing to be sent by the same scammers. The messages appear to create a sense of urgency by claiming a payment problem or storage issue must be resolved immediately.
The phishing emails originate from a wide range of domains, with most appearing to be randomly generated for the spam campaign, as shown in the sample list below.
The emails themselves use a wide variety of subject lines, all designed to scare a recipient into opening the email.
Many of the subject lines are personalized with the recipient's name or email address and include specific dates or identifiers to increase urgency and make the messages appear legitimate.
The email seen by BleepingComputer claims that a cloud subscription renewal failed or that a payment method has expired, with recipients warned that backups may stop syncing and that photos, videos, documents, and device backups could be lost if the issue is not resolved.
