Threat actors are increasingly leveraging legitimate cloud services to host phishing infrastructure, bypassing traditional security measures. Platforms like Cloudflare Workers, Vercel, Netlify, and GitHub Pages are favored due to their inherent trust, generous free tiers, and ease of onboarding, often without Know Your Customer (KYC) verification. These services allow attackers to create numerous malicious accounts and obscure their origin IPs behind Content Delivery Networks (CDNs).

Attackers exploit shared subdomains, making it difficult for security teams to block malicious sites without impacting legitimate users. A recent analysis of phishing campaigns between August 2025 and July 2026 revealed that Cloudflare and Vercel were the most abused cloud domains, with security solutions blocking 224,984 unique third-level domains on such services.

A multi-stage attack demonstrated how phishers use a compromised website to relay users to a Cloudflare Workers subdomain. This stage harvests email addresses and filters bots. Subsequently, a service worker registered in the victim's browser intercepts network requests, enabling an adversary-in-the-middle (AitM) attack. This is combined with a browser-in-the-browser (BitB) technique to spoof a legitimate login window, capturing credentials and MFA codes.