Loading story…
Security researchers reported that cybercriminals are increasingly abusing the InterPlanetary File System (IPFS) to host phishing pages, credential-harvesting kits, and malware payloads on infrastructure that is cheap, decentralized, and difficult to remove. Cisco Talos described campaigns in which DocuSign-themed PDF lures redirected victims to Microsoft-lookalike login pages hosted on IPFS, while other activity used IPFS gateways to deliver second-stage malware. Trend Micro found the trend was dominated by phishing: from mid- to late-2022, phishing made up more than 90% of observed IPFS-related threats each month and reached 98.78% in one month, with more than 23,000 unique phishing pages on IPFS accounting for roughly 9% of global phishing threats in October 2022.
Researchers also observed malware families including Agent Tesla, Formbook, Remcos RAT, and RedLine Stealer using IPFS-hosted content, alongside loader chains that fetched Python stealers, reverse shells, and destructive batch files through interchangeable public gateways. Although the malicious content was stored on IPFS, stolen credentials were often still exfiltrated to conventional web servers, frequently compromised sites, underscoring how attackers blend decentralized hosting with traditional infrastructure. The reports warn that IPFS, IPNS, and related Web3 storage services are becoming attractive criminal infrastructure because gateway switching and takedown resistance complicate blocking, detection, and remediation for defenders.
Get the infrastructure and lures behind it.
9 events from the most recent confirmed update back to the earliest known activity.
In October 2022, Trend Micro counted more than 23,000 unique phishing pages hosted on IPFS and said unique IPFS CIDs represented 9% of the global phishing threat.
Trend Micro reported that phishing made up 98.78% of global IPFS threats in September 2022, showing phishing had become the overwhelmingly dominant abuse case on the platform.
Trend Micro analyzed IPFS-related cybercriminal activity over a telemetry period spanning June through October 2022, during which phishing dominated observed threats and malware hosting was also documented.
Trend Micro said threats represented 1.8% of global IPFS traffic in May 2022, providing an early baseline for malicious activity on the network.
Cisco Talos said it observed an increase during 2022 in malware samples uploaded to public repositories that relied on IPFS for payload hosting.
Cisco Talos reported multiple ongoing malicious campaigns using IPFS to host phishing kits and malware payloads, including DocuSign-themed credential theft and Agent Tesla delivery chains.
Trend Micro reported that cybercriminals have increasingly used IPFS since 2021 to share files, tutorials, screenshots, and illegal ecommerce content in underground forums, marking broader criminal adoption of the platform.
Cisco Talos identified three malware clusters likely tied to the same threat actor that used similar loaders to retrieve IPFS-hosted payloads, including a Python stealer, reverse shells, and a destructive batch file.
Cisco Talos observed an ongoing malspam campaign in which a lure referencing SWIFT payments delivered a downloader that fetched obfuscated content from an IPFS gateway and ultimately loaded Agent Tesla.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
malpedia.caad.fkie.fraunhofer.de
Open sourcetrendmicro.com
Open sourceblog.talosintelligence.com
Open sourceupx.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly hosting phishing infrastructure on legitimate cloud and decentralized platforms, including **Cloudflare Workers**, **Cloudflare Pages**, **Vercel**, **GitHub Pages**, **Netlify**, and **IPFS** gateways, to evade detection and benefit from trusted shared-domain reputation and free-tier scalability. Securelist reported that defenders blocked **224,984** unique third-level domains tied to phishing on these services between August 2025 and July 2026, and identified and neutralized more than **390,000** phishing pages. One documented campaign used a compromised website as an initial relay before directing victims to Cloudflare Workers subdomains for staging, where attackers deployed service workers and the **Ultraviolet** proxy library to transparently intercept traffic in an adversary-in-the-middle attack. The operation also used a browser-in-the-browser spoof to imitate Microsoft login prompts and steal **credentials**, **MFA codes**, and **session tokens**, underscoring how legitimate cloud infrastructure is being repurposed to support large-scale credential theft.
Aug 4, 2026
Researchers from Confiant, Infoblox, and Netskope reported sustained criminal abuse of traffic distribution systems (TDSs) to filter, cloak, and route victims into scams and malware. Confiant and Infoblox found that attackers have extensively weaponized **Keitaro**, a self-hosted ad-tracking platform, across an ecosystem of roughly **15,500 malicious domains**, including about **9,000** registered specifically for abuse. Their four-month analysis found traffic arriving from programmatic ads, spam, social media, and compromised websites, then being selectively redirected based on device, geography, IP address, and referrer. Investment fraud was the dominant use case, with clusters such as **FaiKast** using deepfake news-style cryptocurrency ads, **WickedWally** targeting U.S. seniors with fake benefits and debt-relief offers, and **FishSteaks** running giveaway scams impersonating consumer brands. Netskope separately documented a parallel TDS-for-hire operation built around more than **12,700** fake CAPTCHA PDF files hosted on Webflow’s CDN and indexed by Google as benign upgrade guides. Those PDFs fed users into a custom **Elixir/Phoenix** routing platform that screened visitors through IP reputation, bot detection, geography, and device checks before sending qualified victims to malware or scam pages and diverting others to ad-arbitrage content. The downstream payloads included **Legion Loader**, a reseller TDS gate linked to `yfdpco` domains, and a Spanish-language premium-SMS fraud scheme. Researchers said the infrastructure has persisted for more than 14 months despite rotating lure domains, underscoring how commercial-style tracking and routing software is being repurposed at scale to industrialize online fraud and malware delivery.
Aug 6, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026