Threat actors are increasingly abusing legitimate cloud platforms — Cloudflare Pages, Vercel, GitHub Pages, Netlify, and IPFS — to host phishing infrastructure. A detailed multi-stage adversary-in-the-middle (AitM) attack is analyzed: it begins with a fake CAPTCHA on a compromised site to harvest emails, then registers a browser service worker using the Ultraviolet open-source proxy library to intercept all traffic, and finally combines AitM with a browser-in-the-browser (BitB) UI spoofing technique to steal MFA session tokens. Over 12 months, 224,984 unique malicious third-level domains were blocked across these platforms, with Cloudflare Pages (24.9%), Vercel (13.8%), and GitHub Pages (13.7%) topping the list. Defenses include inspecting the real browser address bar, avoiding unexpected login pop-ups, and treating CAPTCHAs requesting personal data as suspicious.
