Phishers are hijacking legitimate cloud infrastructure

The threat landscape has shifted from using obscure hosting to abusing mainstream cloud services that offer instant, free deployment without identity checks. Engineers building security tooling must now treat any subdomain of a major PaaS as a potential phishing vector, rather than assuming only obscure domains need scrutiny. This change expands the attack surface dramatically, as the provider’s reputation masks malicious activity.

The attack’s core lever is a service worker, a browser feature designed for offline support, which runs without user prompts on HTTPS sites. By embedding an open-source proxy library, the attacker can intercept all subsequent network requests from the victim’s tab, effectively performing a man-in-the-middle without needing a separate server. For developers, this means that any web app that permits arbitrary service-worker registration could be co-opted for credential harvesting.

Mitigating the risk involves adding content-analysis pipelines that inspect the JavaScript served from cloud subdomains for known proxy patterns, and tightening platform policies such as requiring verification before allowing service-worker registration. The operational cost includes monitoring large volumes of short-lived subdomains and possibly integrating browser-level alerts for unusual service-worker activity. These measures stop short of blocking the entire provider domain, preserving legitimate traffic while targeting the malicious scripts.

The attack loses effectiveness if browsers enforce explicit user consent for service-worker installation or if cloud providers impose stricter onboarding, such as mandatory KYC or limits on free subdomain creation. In those environments, the attacker would need to revert to more detectable hosting methods, raising the chance of early detection. Engineers should watch for policy changes on major PaaS providers as a signal that the attack vector may be narrowing.

Overall, the shift to legitimate cloud infrastructure forces security operations to move from static blocklists to dynamic, behavior-based detection that can differentiate benign developer activity from malicious abuse. The cost of adopting such detection is higher computational overhead and potential false positives, but the alternative is exposure to phishing campaigns that can bypass traditional network defenses.