It is happening now
If white hats are using cloud services for attacks, we can be sure that the nasty ones are already doing this.
That should come as no surprise, given cloud platforms' very attractive features for this kind of activity: scale, immediacy, location independence, low cost, virtualisation and the associated anonymity to name a few.
Platform providers need to be vigilant in who they provide services to - but this is countered by the desired ease of use and onboarding needed to make those platforms attractive.
I am sure we haven't heard the last of this yet.