Phishers are hijacking legitimate cloud infrastructure

Threat actors are increasingly exploiting legitimate cloud services like Cloudflare Workers, Vercel, Netlify, and GitHub Pages to host phishing pages and conduct attacks, taking advantage of these platforms' trusted reputation, free developer accounts, and built-in security features that make detection difficult. These cloud services provide phishers with anonymity through CDN masking and shared subdomains, making it impractical for security teams to block malicious content without affecting legitimate users. The article analyzes real-world adversary-in-the-middle attacks deployed on cloud infrastructure and provides statistics on the most-abused platforms and domains.