Attackers are using services such as Cloudflare Workers and GitHub Pages to make fake Microsoft 365 login pages appear legitimate and evade detection.
Kaspersky says it has identified more than 390,000 phishing attacks over the past 12 months that made use of legitimate cloud infrastructure, a tactic that is making malicious traffic harder to distinguish from ordinary web activity. The security firm said the campaigns abused services including Cloudflare Workers, Vercel, Netlify, GitHub Pages and IPFS, taking advantage of the credibility that comes with well-known platforms.
The company’s researchers warned that the shift to trusted infrastructure complicates both user judgement and automated detection. Because the hostile pages are delivered from recognised technology domains, they can appear more trustworthy than the suspicious lookalike sites that once characterised much phishing activity. Attackers also benefit from free hosting tiers, simple deployment and the ability to serve dynamic content, which makes the malicious pages easier to maintain and adapt.
Kaspersky highlighted a campaign aimed at Microsoft 365 users that begins with an email designed to look as though it has come from a known contact. The message points to a page posing as an anti-bot check, but the supposed verification step asks for a work email address, giving the attackers an early opportunity to profile the victim. The browser is then pushed to a page on a legitimate Cloudflare Workers subdomain, where a genuine CAPTCHA is loaded to help the process look credible before a fake Microsoft 365 sign-in window appears.
That second stage uses a Browser-in-the-Browser technique, which recreates a login window inside a webpage and can be convincing enough to fool even careful users. According to Kaspersky, the form is designed to harvest usernames, passwords, multifactor authentication codes and session cookies. The latter two are especially sensitive because they can allow attackers to bypass additional verification and take over already authenticated sessions. The victim is then sent to a generic error page, a move intended to hide the theft and delay suspicion.
The broader trend is consistent with other recent threat reporting. Infosecurity Magazine reported that cloud account attacks increased sixteenfold in 2023, with attackers increasingly stealing short-term tokens and abusing application programming interfaces to gain access and escalate privileges. Google Cloud has also warned that ransomware groups are relying more heavily on legitimate public tools, while Netskope has documented multiple campaigns that abused cloud services to distribute malware. Taken together, the reports suggest that the abuse of trusted infrastructure is becoming a central feature of modern phishing and intrusion activity.
Kaspersky said users should be wary of CAPTCHAs that ask for personal information, since standard verification checks do not need an email address. It also advised treating unexpected sign-in requests with caution, even when the page shows a valid security certificate, and checking the browser’s address bar carefully. In Browser-in-the-Browser attacks, the false window may imitate many interface details, but it cannot alter the real URL shown in the main browser bar.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
