224,984 unique third-level domains on cloud and decentralized services were blocked by the author's security solutions between August 2025 and July 2026 — part of a wider effort that neutralized over 390,000 phishing pages hosted on legitimate platforms and IPFS gateways during the same period.
Why reputable cloud platforms have become a phishing safe haven
Threat actors are deliberately migrating phishing infrastructure to Platform-as-a-Service offerings and distributed cloud environments for reasons the platforms themselves provide: inherent trust and reputation, generous free tiers, and near-instant onboarding that rarely requires Know Your Customer (KYC) verification. The platforms cited most often in the telemetry include Cloudflare Workers, Cloudflare Pages (pages.dev), Vercel (vercel.app), Netlify (netlify.app), and GitHub Pages (github.io).
Those services automatically issue SSL/TLS certificates, provide global CDNs, and host millions of legitimate projects on shared parent domains. That combination makes blocking at the apex domain impractical — security teams risk high collateral damage — while enabling operators to create hundreds of malicious accounts and programmatically generate subdomains at scale.
A real-world multi-stage AitM attack in the cloud
The analyzed campaign used a three-stage adversary-in-the-middle (AitM) technique that moved a victim across a compromised site and Cloudflare Workers subdomains, using browser features and legitimate libraries to capture credentials and multi-factor authentication (MFA) tokens.
- Stage 1 — Contact harvesting and sandbox evasion: A phishing email led the target to a fake CAPTCHA landing page on a compromised site (a disposable relay). If the victim entered an email and clicked Continue, the page marked the user as human and redirected them to a subdomain of workers.dev. The victim’s email was embedded in the URL hash, allowing the Cloudflare-hosted page to extract it without issuing an observable network request.
- Stage 2 — Initializing a transparent proxy: After passing a genuine CAPTCHA, a service worker was registered in the victim’s browser. Because service workers are treated as normal site features over HTTPS, the browser executed it without user consent. The service worker deployed Ultraviolet, a legitimate open-source web proxy library, to rewrite outgoing links and forms so that requests — including those to Microsoft login endpoints — routed through the attacker’s proxy. The email was preserved in sessionStorage and passed across stages via the URL hash to avoid network detection.
- Stage 3 — Session hijacking with BitB UI spoofing: The final page combined AitM interception with a browser-in-the-browser (BitB) visual spoof. The script rendered a pop-up that mimicked a native browser window and displayed a spoofed address bar showing a trusted Microsoft URL; an iframe inside the pop-up loaded the authentic login interface but routed through the service worker proxy. When victims entered credentials and MFA codes, the proxy intercepted credentials and session tokens. The interface was then instructed to close and redirect the user to a generic error page (for example, SessionExpired), leaving the attacker with a live session.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →Which domains and platforms were most abused
Telemetry covering August 2025–July 2026 identified the top cloud and decentralized domains abused to host phishing links. The TOP 10 list by share of phishing links is:
- pages.dev (Cloudflare Pages): 24.9%
- vercel.app (Vercel): 13.8%
- github.io (GitHub Pages): 13.7%
- netlify.app (Netlify): 10.0%
- dweb.link (IPFS gateway): 7.8%
- ipfs.io (IPFS): 5.3%
- workers.dev (Cloudflare Workers): 2.5%
- wixstudio.com (Wix Studio): 1.9%
- webflow.io (Webflow): 1.0%
- azurewebsites.net (Microsoft Azure): 1.0%
Other domains made up the remaining 17.9% of observed phishing links. The analysis concluded that decentralized networks pose an additional risk because content persistence means a blocked gateway can be bypassed via alternative nodes.
How technologists, enterprises, and end users should respond
Technologists and security teams: Relying on apex-domain reputation and simple deny-lists is inadequate; defenders must advance content-based analysis methodologies that detect malicious behavior within legitimate-hosted pages. Blocking entire parent domains is not a long-term solution where millions of legitimate projects reside.
Enterprises and procurement leaders: Treat CAPTCHAs that request personally identifiable information as suspicious and consider controls that inspect or quarantine externally hosted links. Email security at the delivery stage remains important: the report cites Kaspersky Secure Mail Gateway as an enterprise measure that can neutralize phishing links before they reach inboxes.
End users: Exercise caution with unexpected login prompts even when they appear on reputable domains or display valid SSL/TLS certificates. Inspect the main browser address bar (the true address bar at the top of the browser window) for mismatches with any pop-up, avoid entering credentials in unexpected pop-ups, and navigate to services manually. For personal protection, the report highlights Kaspersky Premium as an additional protection option.
Recommendations and a closing observation
The core defensive prescription in the data is layered: combine improved content-based inspection, user education on CAPTCHA and BitB indicators, and stronger email-gateway controls to stop malicious links at delivery. Traditional trust signals — HTTPS lock icons and positive apex-domain reputations — can be weaponized; defenders must assume attackers will continue to exploit platforms that offer free tiers, automated certificates, and shared subdomain hosting.
The telemetry is stark: 224,984 unique third-level domains blocked and over 390,000 phishing pages neutralized in a single year show that phishers are systematically moving into the same cloud services used by legitimate developers. If defenders do not move beyond reputation-based blocking to behavior- and content-focused analysis, these platforms will remain a preferred vector for AitM and MFA-bypass campaigns.
