Kaspersky: 390,000 phishing attacks exploited cloud platforms
Kaspersky has published research showing that more than 390,000 phishing attacks over the past 12 months have exploited legitimate cloud platforms, including Cloudflare Workers, Vercel, Netlify, GitHub Pages and IPFS. The campaigns combine multi-stage social engineering with Browser-in-the-Browser (BiTB) techniques to harvest corporate credentials and session cookies, bypassing multi-factor authentication in the process.
The attack chain described in the report begins with a lure email directing a victim to a fake anti-bot page. The page prompts the target to enter their corporate email address under the guise of a CAPTCHA check. That address is passed to a Cloudflare Workers subdomain via a URL hash, keeping the data transfer server-side and reducing the chance of detection. A second, genuine CAPTCHA is then injected dynamically into the page to complicate automated analysis by security tools. The victim is finally presented with what appears to be a standard Microsoft Office 365 login window, constructed using the BiTB technique to render a convincing floating browser frame. All credentials and session tokens entered are forwarded silently to the attacker's infrastructure.
Olga Altukhova, cybersecurity expert at Kaspersky, said: "Phishers were able to create a multi-stage Adversary-in-the-Middle attack, proxying all traffic from what looked like a legitimate Microsoft website and combining it with Browser-in-the-Browser techniques. This shows how phishing techniques are becoming more and more sophisticated."
Why cloud infrastructure complicates detection
The use of reputable cloud platforms is central to this threat model. Domains under cloudflare.com, github.io and similar services carry high reputation scores in most commercial threat-intelligence feeds, and their TLS certificates are valid, meaning browser-level warnings are not triggered. Free-tier hosting plans on these platforms reduce attacker cost to near zero, lowering the barrier to running high-volume campaigns. Security teams relying on domain-reputation filters alone are poorly positioned to catch these attacks, because the infrastructure used is shared with millions of legitimate applications.
This approach is part of a broader trend in which adversaries repurpose the same developer tooling used by enterprise engineering teams. Cloudflare Workers, for instance, is widely adopted for edge-compute use cases by the same organisations being targeted. This creates a difficult policy problem: blocking the platforms outright is not viable, while allowing all traffic from them uncritically hands attackers a persistent evasion channel.
Defensive posture and regulatory read-across
Kaspersky recommends that organisations instruct staff to treat any CAPTCHA step requesting personal data as a phishing indicator, verify URLs in the main browser chrome rather than within pop-up windows, and deploy security tooling capable of inspecting dynamically injected page scripts rather than relying solely on domain reputation.
From a standards and compliance perspective, the MFA-bypass element of this campaign is directly relevant to organisations subject to NIS2, which took effect across EU member states in late 2024, and to financial-services firms under DORA, which came into force in January 2026. Both frameworks require documented incident-response procedures and resilience testing; credential-harvesting attacks that circumvent MFA controls are precisely the scenario regulators expect covered entities to have modelled.
The findings also arrive as the EU Cyber Resilience Act begins imposing security-by-design obligations on software and connected-product vendors. Cloud platform providers whose free tiers are systematically abused for phishing infrastructure may face growing pressure to demonstrate abuse-detection controls, particularly as national cybersecurity agencies in the UK (NCSC) and Europe (ENISA) sharpen their guidance on supply-chain and third-party platform risk.