Loading story…
Phishing operators are abusing trusted cloud-hosting services and decentralized networks to deploy credential-harvesting pages that evade conventional trust checks. Kaspersky identified nearly 400,000 phishing URLs on such infrastructure between July 2025 and June 2026, with pages.dev, vercel.app, and github.io among the most frequently abused hosting domains.
The campaigns combine adversary-in-the-middle (AiTM) proxying with browser-in-the-browser (BiTB) spoofing. A typical chain begins with a phishing email and compromised-site pseudo-CAPTCHA, then directs selected victims to a cloud-hosted transparent proxy that presents a fake browser window around a legitimate authentication flow. This enables attackers to capture passwords, MFA codes, and authenticated session tokens; organizations should layer phishing-link filtering, endpoint protection, and employee awareness measures.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
From July 2025 through June 2026, researchers identified nearly 400,000 phishing URLs hosted on popular cloud platforms and decentralized networks. The most frequently abused hosting domains included pages.dev and vercel.app, followed by github.io.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly hosting phishing infrastructure on legitimate cloud and decentralized platforms, including **Cloudflare Workers**, **Cloudflare Pages**, **Vercel**, **GitHub Pages**, **Netlify**, and **IPFS** gateways, to evade detection and benefit from trusted shared-domain reputation and free-tier scalability. Securelist reported that defenders blocked **224,984** unique third-level domains tied to phishing on these services between August 2025 and July 2026, and identified and neutralized more than **390,000** phishing pages. One documented campaign used a compromised website as an initial relay before directing victims to Cloudflare Workers subdomains for staging, where attackers deployed service workers and the **Ultraviolet** proxy library to transparently intercept traffic in an adversary-in-the-middle attack. The operation also used a browser-in-the-browser spoof to imitate Microsoft login prompts and steal **credentials**, **MFA codes**, and **session tokens**, underscoring how legitimate cloud infrastructure is being repurposed to support large-scale credential theft.
Aug 4, 2026
Phishing-as-a-service platforms continued to industrialize account takeover operations, with kits such as **Tycoon2FA**, **EvilProxy**, **Sneaky 2FA**, **CryptoChameleon**, **Darcula**, **Evilginx**, and **EvilTokens** enabling attackers to steal credentials, session cookies, MFA responses, payment-card data, and OAuth tokens at scale. Reporting across 2025 and 2026 described more than a million PhaaS attacks in a two-month period, a possible **CryptoChameleon** social-engineering campaign targeting LastPass and cryptocurrency users, and a targeted adversary-in-the-middle campaign against **RBC Express** online banking customers that used malvertising and cloaking to bypass multi-factor authentication. Researchers also documented a shift from fake login pages toward token theft and abuse of legitimate authentication workflows. A July 2026 analysis tied a bulk phishing platform dubbed **Mailer-Go Mission Control** to **EvilTokens** operations abusing Microsoft's OAuth device-code flow, while sector reporting said AiTM phishing had become the top initial access vector for law firms, with **Tycoon2FA** responsible for over half of AiTM-related compromises in that sector during 2025 despite a March 2026 disruption. The combined reporting warned that modern phishing kits lower the barrier to entry with automation, domain management, and real-time victim interaction, and recommended **phishing-resistant MFA** such as FIDO2/WebAuthn, conditional access, managed-device controls, and rapid revocation of compromised sessions and refresh tokens.
Aug 15, 2026
Threat actors are increasingly using **trusted platforms**—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a **three-step malvertising chain** delivered via **Facebook paid ads** that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a **tech support scam (TSS) kit** hosted on **Microsoft Azure** infrastructure (including `web.core.windows.net`). Researchers reported rapid infrastructure churn, with **100+ domains rotated in seven days**, and targeting focused on **U.S. users** with activity concentrated on weekdays. Parallel enterprise-focused campaigns are hosting phishing infrastructure on **Microsoft Azure Blob Storage**, **Google Firebase**, and **AWS CloudFront**, using **redirect chains, CAPTCHA gates, and QR codes** to bypass automated analysis and email defenses. Analysis highlighted the use of **Adversary-in-the-Middle (AiTM)** phishing-as-a-service kits—**Tycoon2FA**, **Sneaky2FA**, and **EvilProxy**—to steal credentials and **session tokens** even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal **Dropbox** credentials: benign-looking procurement-themed emails deliver **PDF attachments** that hide clickable elements (e.g., via *AcroForms* and `FlateDecode`), which then route victims to a second-stage file hosted on **Vercel Blob** and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).
Jun 29, 2026