Threat actors are increasingly leveraging legitimate cloud services to host phishing infrastructure, enabling them to bypass traditional security measures and multi-factor authentication (MFA). Researchers have observed a consistent migration of phishing operations to platforms such as Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS throughout 2025 and 2026. This trend is driven by the inherent trust associated with these platforms, their generous free-tier developer plans, and features that aid in evasion and anonymity.
The use of reputable cloud platforms allows phishing pages to appear more trustworthy to potential victims. Many of these services offer free developer accounts that are easy to set up, often without requiring Know Your Customer (KYC) identity verification, which facilitates the creation of numerous malicious accounts by a single operator. Furthermore, attackers exploit native security features, such as Content Delivery Networks (CDNs), to obscure their true origin server IP addresses, complicating detection. The shared subdomain structure of these platforms, hosting millions of legitimate projects, also prevents security teams from broadly blocking parent domains without impacting legitimate users.
A sophisticated adversary-in-the-middle (AitM) phishing campaign observed by researchers demonstrates this technique, specifically utilizing Cloudflare Workers. This multi-stage attack involves several HTML pages distributed across a compromised website and the cloud platform, each serving a distinct function: harvesting target email addresses, initializing a reverse-proxy, or spoofing login forms to capture MFA sessions.
The attack typically begins with a phishing email containing a malicious link, often disguised as a request to review documents. Clicking this link redirects the user to a fake CAPTCHA landing page hosted on a compromised legitimate website, which acts as a disposable relay to prevent early detection of the core phishing content. This initial stage harvests the target's email address and filters out bots. If the user enters their email and passes the pseudo-CAPTCHA, they are redirected to a subdomain of `workers.dev`, a free and automatically generated Cloudflare Workers subdomain. The victim's email address is embedded in the URL hash, allowing the subsequent page to extract it without server requests, thus evading detection.
In the second stage, the user's browser loads the `workers.dev` page, which presents a genuine CAPTCHA challenge to confirm human interaction. Upon successful completion, a service worker is registered in the browser. This JavaScript file, a core component of progressive web apps (PWAs), runs in the background and intercepts all network requests from the current tab. Attackers exploit this by deploying Ultraviolet, a legitimate open-source web proxy library, to dynamically rewrite all links and forms. This forces all outgoing requests, including those for Microsoft login credentials, to route through the attacker's server instead of directly to legitimate services. The victim's email, extracted from the URL hash and stored in `sessionStorage`, is used to pre-fill the username field, enhancing credibility. The email address is continuously passed via the URL hash across all stages to avoid network detection.
The final stage combines AitM traffic interception with a browser-in-the-browser (BitB) UI spoofing technique. A script on the attacker's page generates a pop-up window that visually mimics a native browser window, complete with controls and a spoofed address bar displaying a trusted Microsoft URL. Within this simulated window, an iframe loads the authentic login interface, routed through the service worker reverse proxy established in Stage 2. When the victim enters their credentials and MFA code into this BitB window, the proxy intercepts both the credentials and the session tokens.
The combination of BitB and AitM significantly amplifies the threat: BitB provides a convincing visual wrapper with a legitimate-looking URL, while the hidden AitM proxy silently intercepts traffic and hijacks sessions. After a successful login, the interface closes the pop-up and redirects the victim to a generic error page, such as "SessionExpired," to minimize suspicion. The victim, unaware that their session has been compromised, may simply assume a technical glitch and attempt to log in again.
Analysis of phishing URLs hosted on cloud platforms, including Cloudflare, Netlify, and GitHub Pages, over a 12-month period from August 2025 to July 2026, revealed that security solutions blocked 224,984 unique third-level domains on cloud and decentralized services used for phishing content delivery. This highlights the scale of the problem and the ongoing challenge for security vendors to develop advanced content-based analysis methodologies to counter these tactics.
