Phishers Exploit Legitimate Cloud Platforms to Evade MFA
Cybercriminals are increasingly leveraging trusted cloud platforms like Cloudflare Workers, Vercel, and Netlify to host sophisticated phishing pages that bypass multi-factor authentication.
Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks have become primary platforms for hosting phishing pages and sites. Throughout 2025 and 2026, researchers have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS, drawn by their inherent trust, generous free tiers, and ease of use.
These platforms offer significant advantages to attackers. Their inherent trust and reputation make phishing pages hosted on them appear more legitimate, reducing victim suspicion. Furthermore, many platforms offer generous free-tier developer plans with minimal onboarding requirements, often without Know Your Customer (KYC) identity verification. This allows a single operator to create hundreds of malicious accounts with relative ease, complicating efforts to ban them.
Attackers also leverage native security features to obscure their true origin server IP addresses behind Content Delivery Networks (CDNs), which complicates detection for security vendors. Additionally, these platforms allocate shared subdomains that host millions of legitimate projects and websites. Security teams cannot simply block the parent domain or its subdomains without inflicting collateral damage on bona fide users, a limitation that malicious actors exploit. To counter this tactic, security vendors must advance content-based analysis methodologies.
A modern adversary-in-the-middle (AitM) phishing campaign often leverages platforms like Cloudflare Workers. The attackers execute the operation through multiple HTML pages distributed across a compromised website and the cloud platform. Each page serves a specific function: harvesting target email addresses, initializing reverse-proxy infrastructure, or spoofing login forms to capture multi-factor authentication (MFA) sessions.
The attack typically begins with a phishing email using a plausible pretext, such as a request from a coworker to review documents, to entice the target into clicking a malicious link. Upon clicking, the user is redirected to a fake CAPTCHA landing page hosted on a compromised legitimate website. This disposable relay prevents early discovery of the core phishing content hosted on Cloudflare, as direct phishing links are typically blocked faster.
If the user enters their email address and clicks 'Continue,' the pseudo-CAPTCHA marks them as a human and initiates a redirect to a Cloudflare Workers subdomain. The victim's email address is embedded in the URL hash, allowing the subsequent page to extract it without issuing a server request, thus avoiding detection. This stage's primary objective is to harvest email addresses and filter out bots.
The user's browser then loads a workers.dev page with the email in the URL hash. This page presents a genuine CAPTCHA challenge to ensure an actual user is interacting with it. After passing the CAPTCHA, a service worker is registered in the browser. This JavaScript file can intercept all network requests, and browsers treat it as a standard site feature. Attackers leverage this to deploy Ultraviolet, an open-source web proxy library, to dynamically rewrite all links and forms, forcing outgoing requests—including those for credentials—through the attackers' server.
The final stage combines AitM traffic interception with a browser-in-the-browser (BitB) UI spoofing technique. This sophisticated multi-stage attack, leveraging trusted cloud infrastructure, allows attackers to harvest credentials and MFA sessions, posing a significant challenge to traditional security measures.