Phishers are hijacking legitimate cloud infrastructure

Threat actors are exploiting Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS to host phishing pages. A real-world attack used Cloudflare Workers with a service worker running Ultraviolet to intercept Microsoft login credentials and MFA sessions. Security solutions blocked 224,984 unique third-level domains and neutralized over 390,000 phishing pages in 12 months.