12 ways attackers abuse cloud services to hack your enterprise

Attackers have evolved from 'living off the land' to 'living off the cloud,' abusing trusted SaaS platforms, cloud APIs, and identity systems to blend malicious activity into legitimate enterprise traffic. Twelve specific techniques are covered: routing C2 through Google Sheets, OpenAI APIs, and Microsoft Graph API; staging malware payloads in S3 buckets; exfiltrating data via Slack and Discord; running full cloud-native kill chains; hosting phishing pages on legitimate Microsoft infrastructure; abusing AWS Lambda for ephemeral scanning; using Cloudflare Tunnel or ngrok for firewall bypass; weaponizing EBS snapshot sharing for credential dumping; exploiting Entra ID tenant trust relationships; harvesting secrets from AWS Secrets Manager; and deploying cloud-native malware frameworks like VoidLink targeting AWS, Azure, GCP, and Kubernetes.