GCP Pub/Sub CloudStorage Subscription Bucket Deletion then Hijack

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•4

Detects a sequence of events where a Google Cloud Storage bucket is deleted by a user, followed by the creation or modification of a Pub/Sub subscription referencing a Cloud Storage destination. This pattern is indicative of 'Universal Bucket Hijacking', where an attacker attempts to hijack a data stream by recreating a deleted bucket or reconfiguring a service to redirect traffic to an attacker-controlled destination.