Around 390,000 phishing attacks ran through well-known cloud services over a twelve-month period. That shows how heavily cybercriminals now rely on established cloud infrastructure. According to Kaspersky, the attackers abused services including Cloudflare Workers, Vercel, Netlify, GitHub Pages, and the InterPlanetary File System (IPFS).
Why known cloud domains make good cover
The advantage for the attackers lies in the reputation of these platforms: security solutions and users don't automatically flag well-known cloud domains as suspicious. On top of that come free tiers and tools that let attackers assemble parts of a phishing campaign without any server infrastructure of their own. "Attackers abuse legitimate services because they carry high reputation along with free tiers or tools that can be exploited for their purposes," explains Olga Altukhova, a cybersecurity expert at Kaspersky. "In the example we identified, the phishing actors implemented a multi-stage adversary-in-the-middle attack. They relayed all traffic through what appeared to be a legitimate Microsoft webpage and combined this approach with browser-in-the-browser techniques."
Four stops on the way to a fake login
The campaign starts with an email designed to look like it comes from a known contact. A link in it leads to a supposed Microsoft account login, but the actual attack runs through several staged pages first. A fake anti-bot check styled like a CAPTCHA first asks for the visitor's business email address. That address then gets passed to a subdomain via Cloudflare Workers, where it sits in the URL hash and can be read out without the next page needing to contact an attacker-controlled server directly. A second, genuinely functioning CAPTCHA check follows, but it's only dynamically loaded into the page during the visit, which makes automated analysis harder. At the end sits a recreated Microsoft 365 window that uses browser-in-the-browser techniques to simulate a real login prompt.
This final stage isn't just for show. Through the form, the attackers capture usernames, passwords, MFA codes, and session cookies. The victim then often lands on a generic error page, making the whole process look like a failed login even though the credentials have already been stolen.
MFA doesn't protect against every attack
The campaign exposes a weakness in the common assumption that multi-factor authentication makes phishing largely ineffective. In this case, the attackers request the MFA code alongside the password and additionally capture the user's session, an approach Kaspersky classifies as a multi-stage adversary-in-the-middle attack. That shifts what defense needs to focus on: it's no longer just about protecting the account, but also about checking the login context and the page being visited. Known cloud services aren't a reliable signal of legitimacy here; their genuinely legitimate infrastructure is exactly what makes such campaigns harder for classic filters to catch.
How to protect yourself
Scrutinize CAPTCHA prompts, since they normally don't ask for personal information like an email address. Question unexpected login prompts on principle, phishing can run even on known cloud domains or behind a valid SSL certificate. If something seems off, check the address bar of your browser's main window: in browser-in-the-browser attacks, window frames and address bars can be recreated inside a webpage, but the browser's actual address bar can't be altered. Keep your browser and security extensions up to date, and ideally use a mail security solution that doesn't just judge a domain's reputation but also inspects scripts and dynamically loaded content.