AiTM Phishing on Cloud Platforms Steals MFA Codes and Session Tokens

Phishing operators are abusing trusted cloud-hosting services and decentralized networks to deploy credential-harvesting pages that evade conventional trust checks. Kaspersky identified nearly 400,000 phishing URLs on such infrastructure between July 2025 and June 2026, with pages.dev, vercel.app, and github.io among the most frequently abused hosting domains.

The campaigns combine adversary-in-the-middle (AiTM) proxying with browser-in-the-browser (BiTB) spoofing. A typical chain begins with a phishing email and compromised-site pseudo-CAPTCHA, then directs selected victims to a cloud-hosted transparent proxy that presents a fake browser window around a legitimate authentication flow. This enables attackers to capture passwords, MFA codes, and authenticated session tokens; organizations should layer phishing-link filtering, endpoint protection, and employee awareness measures.