Scams & Phishing News Kaspersky reports threat actors are increasingly exploiting legitimate cloud services like Cloudflare Workers, Vercel, Netlify, etc to evade detection

[Khushal]

Content source

https://securelist.com/cloud-platforms-in-phishing/120832/

How legitimate cloud platforms enable phishers to bypass MFA​

Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks have become primary platforms for hosting phishing pages and sites. Throughout 2025 and 2026, we have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This post analyzes the mechanics of a real-life adversary-in-the-middle (AitM) attack in a cloud environment and presents detailed statistics on the platforms and domains phishers abuse most frequently.

Phishers are hijacking legitimate cloud infrastructure

We cover a cloud-based AitM attack scenario leveraging service workers and Ultraviolet, and provide detailed phishing hosting statistics across platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS.

securelist.com

 

[Bot]

The important distinction is that legitimate cloud platforms do not inherently “bypass” MFA. In an adversary-in-the-middle (AitM) attack, the victim is usually directed to a phishing proxy that relays authentication traffic to the real identity provider. The victim may complete MFA successfully, but the attacker can capture the resulting session cookie or token and reuse it.

Why this works

• Traditional MFA methods such as SMS, voice calls, and many push prompts authenticate the user, but may not cryptographically bind the session to the legitimate browser and origin.
• The phishing proxy can display a convincing login page while forwarding credentials and MFA challenges in real time.
• Compromised session cookies can allow access without repeating the MFA challenge until the session expires, is revoked, or is otherwise re-evaluated.
• Cloud hosting and serverless platforms can provide scalable infrastructure, valid TLS certificates, and reputable domains, which may make blocking more difficult.

Effective mitigations

• Use phishing-resistant authentication, preferably FIDO2/WebAuthn security keys or passkeys.
• Apply conditional-access policies based on device compliance, risk, location, and session behavior.
• Require reauthentication for sensitive actions and use short session lifetimes where practical.
• Enable alerts for unusual sign-ins, impossible travel, new devices, mailbox-rule changes, and suspicious OAuth consent.
• Train users to verify the actual origin and avoid signing in through links in unexpected messages.
• Revoke active sessions and reset credentials promptly if a user may have entered credentials into a phishing page.

A further limitation is that platform-based statistics can be difficult to interpret: a platform may be abused because it is popular and easy to deploy, but that does not indicate that the provider is malicious or that every site hosted there is unsafe. The URL, page behavior, registration details, redirects, and independent reputation data all need to be evaluated together.

The key takeaway is that MFA remains valuable, but phishing-resistant MFA provides substantially stronger protection against real-time proxy attacks than codes or approval prompts alone.