Phishers are hijacking legitimate cloud infrastructure

Threat actors are progressively exploiting morganatic unreality services to evade discovery and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks person go superior platforms for hosting phishing pages and sites. Throughout 2025 and 2026, we person observed phishing operators steadily migrate toward platforms for illustration Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This station analyzes the mechanics of a real-life adversary-in-the-middle (AitM) onslaught successful a unreality situation and presents elaborate statistic connected the platforms and domains phishers maltreatment astir frequently.

The unreality arsenic a safe haven for phishers

Threat actors prime platform-as-a-service (PaaS) offerings and distributed unreality environments to big phishing sites for overmuch the aforesaid reasons morganatic package developers do:

• Inherent spot and reputation. Phishing pages hosted connected reputable platforms look trustworthy, reducing suspicion among imaginable victims.
• Most platforms connection generous free-tier developer plans. The onboarding process takes minutes and seldom requires Know Your Customer (KYC) personality verification. This enables a azygous usability to create hundreds of malicious accounts.
• Evasion and anonymity. Attackers leverage autochthonal information features to obscure their existent root server IP reside down a CDN, which complicates discovery for information vendors.

Additionally, these platforms allocate shared subdomains hosting millions of morganatic projects and websites. Security teams cannot simply artifact the genitor domain aliases its subdomains without inflicting collateral harm connected bona fide users – a limitation that malicious actors return advantage of. To antagonistic this tactic, information vendors must beforehand content-based study methodologies.

Multi-stage AitM attack

Consider a modern AitM phishing run that leverages Cloudflare Workers, a wide adopted unreality platform. The attackers execute the cognition done aggregate HTML pages distributed crossed a compromised website and the unreality platform. Each page serves a circumstantial function: harvesting target email addresses, initializing the reverse-proxy infrastructure, aliases spoofing the login shape to seizure multi-factor authentication (MFA) sessions.

Stage 1. Contact harvesting and web monitoring evasion

The onslaught typically originates pinch a phishing email that uses a plausible pretext – specified arsenic a petition from a coworker to reappraisal documents – to entice the target into clicking a malicious link.

Upon clicking the link, the personification is redirected to a clone CAPTCHA landing page hosted connected a compromised morganatic website. This circumstantial run utilized the https://t[REDACTED]e.com website, but immoderate different variations are possible. In this scenario, the compromised page served arsenic a disposable relay — vendor discovery mechanisms typically artifact phishing links delivered straight via email overmuch faster — to forestall the early find of the halfway phishing contented hosted connected Cloudflare.

If the personification entered their email reside and clicked Continue, the pseudo-CAPTCHA marked them arsenic a quality personification and initiated a redirect. The superior nonsubjective of this shape is to harvest target email addresses, select retired bots, and way morganatic users to a subdomain of workers.dev. Such subdomains are generated automatically and free of complaint by Cloudflare Workers. The victim’s email reside was embedded successful the URL hash (the portion of the URL pursuing the # character), allowing the page astatine [REDACTED].workers.dev to extract the email without issuing a petition to the attacker’s server, thereby avoiding detection.

Stage 2. Initializing a transparent proxy

The user’s browser past loaded a [REDACTED].workers.dev page pinch #[email protected] astatine the extremity of the URL. At this point, the page presented the unfortunate pinch a genuine CAPTCHA challenge. This measurement ensured that an existent personification was interacting pinch the page alternatively than a information sandbox.

Once the personification successfully completed the challenge, a work worker was registered successful their browser. This is simply a typical JavaScript record tin of moving successful the inheritance and intercepting each web requests generated by the existent tab. As this type of book was designed arsenic a halfway constituent of progressive web apps (PWAs) to optimize load times and support offline functionality, browsers dainty work workers arsenic modular tract characteristic and execute them without prompting for personification consent arsenic agelong arsenic the website uses an HTTPS connection.

The attackers leveraged the work worker to deploy Ultraviolet, a morganatic open-source web proxy library, to dynamically rewrite each links and forms connected the page. This forced each outgoing request – including those for Microsoft login credentials – to way done the attackers’ server alternatively than straight to the morganatic services.

Immediately upon loading, the page extracted the victim’s email reside from the URL hash and stored it successful the browser’s sessionStorage spot truthful it would not beryllium overwritten erstwhile the CAPTCHA loaded. This measurement besides allowed the book to pre-fill the username section successful the shape automatically. A pre-populated login section enhanced the page’s credibility and bolstered personification trust. Once the CAPTCHA was passed, the malicious book constructed a redirect URL for the 3rd stage, appending the email retrieved from sessionStorage backmost to the hash. By passing the email via the URL hash crossed 3 consecutive stages, the attackers successfully kept it hidden from web onslaught discovery systems.

Stage 3. Session hijacking and browser model spoofing

The last shape unfolded connected a 3rd page, combining adversary-in-the-middle (AitM) postulation interception pinch a browser-in-the-browser (BitB) UI spoofing technique. BitB attacks run by rendering a artifact wrong a morganatic webpage that visually mimics a autochthonal browser pop-up window.

In this case, the book hosted connected the attacker’s page generated a pop-up visually identical to a autochthonal browser window, complete pinch model controls and a spoofed reside barroom showing a trusted Microsoft URL. Within this simulated window, an iframe loaded the authentic login interface, routed dynamically done the work worker reverse proxy created successful Stage 2. When the unfortunate entered their credentials and MFA codification into the BitB window, the proxy book intercepted some the credentials and the convention tokens. Combining BitB pinch AitM importantly increases the threat: BitB provides a convincing, trusted ocular wrapper (displaying a morganatic URL and branding), while the hidden AitM proxy softly handles postulation interception and convention hijacking down the scenes.

Upon successful login, the proxy instructs the interface to adjacent the pop-up and redirect the unfortunate to a generic strategy correction page, specified arsenic SessionExpired. This minimizes suspicion: the unfortunate assumes a method glitch occurred and attempts to log successful again, unaware that the attacker already has afloat entree to the session.

Cloud level phishing onslaught statistics

We analyzed phishing URLs hosted crossed celebrated unreality platforms – including Cloudflare, Netlify, and GitHub Pages – complete a 12-month play spanning August 2025 to July 2026. The information beneath outlines trends successful unsocial third-level domains exploited to present phishing content. In total, our information solutions blocked 224,984 unsocial third-level domains connected unreality and decentralized services utilized successful phishing attacks wrong that timeframe.

Number of unsocial third-level domains
(download)

Based connected this telemetry, we compiled a database of the TOP 10 unreality domains astir often abused successful phishing campaigns complete the specified period.

Unsurprisingly, Cloudflare and Vercel emerged arsenic the undisputed leaders: some connection free tiers, automated SSL certificate issuance, and world CDNs. GitHub Pages classed third. The wide morganatic usage of the github.io domain complicates bulk blocking efforts, arsenic information teams consequence limiting entree to non-malicious projects.

Decentralized networks besides warrant adjacent attention – we posted connected this subject successful 2023. The ipfs.io and dweb.link domains usability arsenic IPFS gateways. The main consequence associated pinch these platforms is contented persistence: moreover if a circumstantial gateway gets blocked, the phishing page remains accessible via replacement nodes crossed the network.

The ocular website builders Wix and Webflow besides classed among the TOP 10 (eighth and ninth, respectively). These platforms let low-skilled individuals to build phishing pages quickly without precocious coding expertise, which importantly lowers the obstruction to introduction for little tin malicious actors.

In total, we identified and neutralized complete 390,000 phishing pages hosted crossed morganatic unreality platforms and decentralized networks (IPFS) complete the past 12 months. This information confirms that threat actors actively utilization the implicit spot associated pinch morganatic PaaS providers (such arsenic Cloudflare Workers, Vercel, Netlify, and GitHub Pages) and IPFS gateways. High domain reputation, generous free tiers, and built-in evasion capabilities alteration phishers to deploy multi-stage AitM attacks designed to hijack MFA sessions.

Recommendations

Traditional information controls, specified arsenic relying connected HTTPS fastener icons aliases reputation-based domain denylists, are inadequate against these attacks. The unreality provider’s apex domain maintains a affirmative estimation score, while attackers make malicious subdomains programmatically and astatine scale.

Effective defense against these threats calls for a layered information posture:

• Exercise be aware pinch unexpected requests, moreover if they are served from reputable domains aliases secured pinch valid SSL/TLS certificates.
• Treat immoderate CAPTCHA interface requiring individual information input arsenic a imaginable scam. Legitimate CAPTCHA challenges seldom petition personally identifiable information, specified arsenic email addresses.
• Inspect the URL successful the reside barroom astatine the very apical of the browser window. In BitB attacks, threat actors tin render a clone browser pop-up displaying immoderate target URL, moreover a morganatic one. However, the existent reside barroom – located astatine the apical of the main browser model alongside autochthonal navigation controls (Back, Forward, Refresh) – will proceed to show the existent attacker-controlled domain.
• Avoid entering credentials successful pop-ups you did not expect to see. If a login aliases MFA shape appears without your definitive action, adjacent the tab immediately. Navigate to the intended work manually by entering its reside straight into the browser.
• Additional protection tin beryllium provided by Kaspersky Secure Mail Gateway for endeavor environments and Kaspersky Premium for individual correspondence. These robust email information solutions neutralize phishing links astatine the transportation shape earlier they scope the inbox.