The advice to check the address bar before typing a password has a hole in it, and phishers have found it. A campaign analysed by Kaspersky renders a fake browser pop-up inside a real web page, complete with window controls and an address bar showing a trusted Microsoft URL, and loads the genuine login form inside it. Everything the victim can see says Microsoft. Everything they type goes through the attacker.
The technique combines two ideas. Browser-in-the-browser (BitB) draws a convincing imitation of a native pop-up window inside an ordinary page, so the URL it displays is just pixels. Adversary-in-the-middle (AitM) means the attacker relays the victim's traffic to the real service and back, which is what defeats multi-factor authentication: the victim completes the MFA challenge for real, and the attacker keeps the resulting session token. In research published by Olga Altukhova, Kaspersky sets out how one such campaign is built and how much of this activity is now hosted on mainstream cloud platforms.
How the attack works
It runs across three pages. The first arrives as a phishing email with a routine pretext, a coworker asking for a document review, and leads to a fake CAPTCHA on a compromised legitimate website. That page exists to harvest the target's email address and to filter out security sandboxes; using someone else's hacked site as a disposable relay also keeps the real infrastructure out of the first wave of blocklisting. The email address is then passed along in the part of the URL after the # character, which browsers do not send to the server, so it stays invisible to network detection as it travels through all three stages.
The second page sits on a free workers.dev subdomain and presents a genuine CAPTCHA, this time to confirm a human is present. Passing it registers a service worker in the victim's browser. Service workers are a standard feature built for offline support in web apps, they can intercept every request the tab makes, and browsers install them without prompting as long as the site uses HTTPS. The attackers use theirs to load Ultraviolet, a legitimate open-source web proxy library, and rewrite every link and form so all traffic routes through their server.
The third page is where the fake window appears, with the real login interface loaded in an iframe behind the proxy. Credentials and the MFA code are captured in transit. The victim is then shown a generic session-expired error and sent to log in again, which reads as a glitch rather than a theft.
Why the cloud platforms
Kaspersky's telemetry covers August 2025 to July 2026. Its products blocked 224,984 unique third-level domains on cloud and decentralised services used in phishing attacks, and the company says it identified and neutralised over 390,000 phishing pages hosted on those platforms across the period. Cloudflare Pages led the top ten with 24.9% of phishing links, followed by vercel.app at 13.8%, github.io at 13.7% and netlify.app at 10.0%. The IPFS gateways dweb.link and ipfs.io took 7.8% and 5.3%, workers.dev 2.5%, with Wix Studio, Webflow and azurewebsites.net making up the rest of the list.
The appeal is the same set of features that makes these platforms good for developers: instant sign-up with no identity verification, generous free tiers, automatic certificates, and a CDN that hides the origin server. The awkward part for defenders is the shared namespace. Blocking the parent domain is not an option when millions of legitimate projects live on it, so a reputation-based denylist has very little to bite on. Kaspersky notes IPFS adds its own problem, since blocking one gateway leaves the content reachable through others.
What you should do
The one reliable check is the outermost address bar, the one sitting next to the browser's own back and refresh controls. A BitB pop-up can draw any URL it likes, but it cannot change that. Beyond that: treat a CAPTCHA that asks for your email address as a scam, because legitimate ones rarely ask for personal data; close any login or MFA prompt that appears without you asking for it, and navigate to the service yourself instead; and be no less suspicious of a link because it sits on a reputable domain with a valid certificate.
None of this is new pressure on MFA so much as a better wrapper around it. Incident response data already shows phishing starting most intrusions with MFA being worked around, and cloud hosting has been part of the pattern for a while, including a campaign that ran off GitHub Pages against Mexican banks.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.