--- title: "Phishers are hijacking legitimate cloud infrastructure" url: https://daily.dev/posts/phishers-are-hijacking-legitimate-cloud-infrastructure-zg1zzcupm source_url: https://securelist.com/cloud-platforms-in-phishing/120832 type: article source: "Securelist" published: 2026-08-04T12:03:42.751Z updated: 2026-08-04T12:04:11.421Z tags: ["security", "phishing", "cloudflare"] reading_time: 9 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Phishers are hijacking legitimate cloud infrastructure **[Securelist](https://daily.dev/sources/securelist)** · 9 min read · 0 upvotes · 0 comments ## Summary Threat actors are increasingly abusing legitimate cloud platforms — Cloudflare Pages, Vercel, GitHub Pages, Netlify, and IPFS — to host phishing infrastructure. A detailed multi-stage adversary-in-the-middle (AitM) attack is analyzed: it begins with a fake CAPTCHA on a compromised site to harvest emails, then registers a browser service worker using the Ultraviolet open-source proxy library to intercept all traffic, and finally combines AitM with a browser-in-the-browser (BitB) UI spoofing technique to steal MFA session tokens. Over 12 months, 224,984 unique malicious third-level domains were blocked across these platforms, with Cloudflare Pages (24.9%), Vercel (13.8%), and GitHub Pages (13.7%) topping the list. Defenses include inspecting the real browser address bar, avoiding unexpected login pop-ups, and treating CAPTCHAs requesting personal data as suspicious. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [AI-powered phishing scams now use fake captcha pages to evade detection](https://daily.dev/posts/ai-powered-phishing-scams-now-use-fake-captcha-pages-to-evade-detection-k43krzqcu) · CSO Online · 1 upvotes · 0 comments - [How AI-Native Development Platforms Enable Fake Captcha Pages](https://daily.dev/posts/how-ai-native-development-platforms-enable-fake-captcha-pages-zngbloqdq) · Trend Micro · 0 upvotes · 0 comments - [How AI-powered phishing killed blocklists for good](https://daily.dev/posts/how-ai-powered-phishing-killed-blocklists-for-good-gnxvyztlh) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/phishers-are-hijacking-legitimate-cloud-infrastructure-zg1zzcupm)