Phishers are hijacking legitimate cloud infrastructure

#1

Post by lschueller » Wed, Aug 05, 2026, 5:20 PM UTC

Phishers are hijacking legitimate cloud infrastructure
securelist.com

Re: Phishers are hijacking legitimate cloud infrastructure

#2

Post by Bender » Wed, Aug 05, 2026, 6:35 PM UTC

Their pie chart almost looks like part of my local DNS configuration. I have not yet blocked github.io or azure however. I built this Unbound DNS configuration file from all the AI submissions in the event I accidentally click on one before noticing the domain.

    local-zone:     "workers.dev." always_null
    local-zone:     "pages.dev." always_null
    local-zone:     "vercel.app." always_null
    local-zone:     "netlify.app." always_null
    local-zone:     "dweb.link." always_null
    local-zone:     "ipfs.io." always_null

    dig +short test.vercel.app
    0.0.0.0

Re: Phishers are hijacking legitimate cloud infrastructure

#3

Post by illithid0 » Wed, Aug 05, 2026, 6:36 PM UTC

Red teamer here. We've been doing this for a long time for all kinds of evasion. Storing payloads in Azure blob storage, for example, is an amazingly effective way to deliver malware through network filtering controls.

You can look at more of the capabilities we like to use at the LOTS project: https://lots-project.com/

Re: Phishers are hijacking legitimate cloud infrastructure

#4

Post by embedding-shape » Wed, Aug 05, 2026, 6:41 PM UTC

Bender wrote: post #2

Their pie chart almost looks like part of my local DNS configuration. I have not yet blocked github.io or azure however. I built this Unbound DNS configuration file from all the AI submissions in the event I accidentally click on one before noticing the domain. local-zone: "workers.dev." always_null local-zone: "pages.dev." always_null local-zone: "vercel.app." always_null local-zone: "netlify.app." always_null local…

> drweb.link."

Considering you have ipfs.io on that list, I wonder if this is a typo for dweb.link actually?

Re: Phishers are hijacking legitimate cloud infrastructure

#5

Post by Bender » Wed, Aug 05, 2026, 6:44 PM UTC

embedding-shape wrote: post #4

Bender wrote: post #2

Their pie chart almost looks like part of my local DNS configuration. I have not yet blocked github.io or azure however. I built this Unbound DNS configuration file from all the AI submissions in the event I accidentally click on one before noticing the domain. local-zone: "workers.dev." always_null local-zone: "pages.dev." always_null local-zone: "vercel.app." always_null local-zone: "netlify.app." always_null local…

> drweb.link." Considering you have ipfs.io on that list, I wonder if this is a typo for dweb.link actually?

That is a typo, I will fix it. Thankyou!

Re: Phishers are hijacking legitimate cloud infrastructure

#6

Post by inigyou » Wed, Aug 05, 2026, 6:47 PM UTC

I bet they have an easier time getting past your blacklist filters than non-phishers.

Re: Phishers are hijacking legitimate cloud infrastructure

#7

Post by heipei » Wed, Aug 05, 2026, 7:36 PM UTC

Legitimate file hosting services present the biggest total volume of newly discovered phishing pages / unique hostnames. Another (similar) angle is using unrelated legitimate domains which are compromised (think insecure Wordpress) to host phishing sites in subdirectories. A lot of traditional ML scoring and blocking approaches fall flat if the hosting domain is on a very legitimate and hard-to-block domain, such as a government website.

Re: Phishers are hijacking legitimate cloud infrastructure

#8

Post by crote » Wed, Aug 05, 2026, 9:26 PM UTC

"Hijacking"? No, those clouds providers are happily hosting phishers.

They simply believe doing the bare minimum of half-hearted anti-abuse is more profitable than doing proper KYC and risking missing out on a legitimate customer or two.

Re: Phishers are hijacking legitimate cloud infrastructure

#9

Post by ronsor » Wed, Aug 05, 2026, 9:42 PM UTC

Bender wrote: post #2

Their pie chart almost looks like part of my local DNS configuration. I have not yet blocked github.io or azure however. I built this Unbound DNS configuration file from all the AI submissions in the event I accidentally click on one before noticing the domain. local-zone: "workers.dev." always_null local-zone: "pages.dev." always_null local-zone: "vercel.app." always_null local-zone: "netlify.app." always_null local…

If you block github.io, you may as well stop using half this site.

Re: Phishers are hijacking legitimate cloud infrastructure

#10

Post by ronsor » Wed, Aug 05, 2026, 9:43 PM UTC

crote wrote: post #8

"Hijacking"? No, those clouds providers are happily hosting phishers. They simply believe doing the bare minimum of half-hearted anti-abuse is more profitable than doing proper KYC and risking missing out on a legitimate customer or two.

I'd take the phishers over more KYC invading everything, quite honestly.