A trusted web service is a legitimate online platform or cloud API that users and security tools normally allow, such as email, storage, or collaboration services. Malware abuses these services to hide command-and-control traffic, move stolen data, or stage files inside requests that look routine. Because the traffic goes to a well-known service over standard HTTPS, it can blend into normal business activity and avoid simple destination-based blocking.
This matters because defenders often trust the service, not the content. In real attacks, threat actors may create calendar events, upload attachments, or pass instructions through APIs that are meant for everyday work. Detection usually depends on looking at behavior, not just network reputation: unusual API calls, impossible timestamps, bulk automation from a mailbox, suspicious attachments, and odd access patterns from apps or accounts. Tight permissions, strong audit logging, and mailbox or SaaS telemetry help reveal when a trusted service has been repurposed as an attack channel.