Over-Privileged IAM Role with storage.buckets.delete Used for Bucket Hijacking

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•2

Detects a sequence of events where an actor deletes a Google Cloud Storage bucket and then immediately recreates it, a pattern consistent with bucket hijacking intended to manipulate resource access or bypass security controls on data streams.