Phishers Exploit Legitimate Cloud Platforms to Bypass MFA in Multi‑Stage AitM Attacks
What Happened — Threat actors are leveraging free‑tier PaaS services such as Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS to host phishing pages that can hijack browser sessions and capture MFA tokens. The attacks use a multi‑stage “adversary‑in‑the‑middle” (AitM) flow: credential harvesting, transparent proxy initialization, and session spoofing, allowing the phishing operator to bypass MFA protections that organizations rely on for SOC 2 compliance.
Why It Matters for Compliance & Audit Readiness
- The scenario directly tests the effectiveness of SOC 2 CC6.1 (Logical Access) and CC6.2 (Multi‑Factor Authentication) controls; a breach would indicate gaps in control design or monitoring.
- Continuous evidence of phishing‑resilience (e.g., security‑awareness training completion, simulated phishing metrics) is essential audit evidence for demonstrating reasonable safeguards.
- Leveraging reputable cloud hosts complicates traditional URL‑blocking; auditors will expect documented vendor‑risk assessments and mitigation policies for cloud‑based phishing vectors.
Who Is Affected — SaaS providers, cloud‑hosting platforms, enterprises that rely on PaaS for internal or customer‑facing applications, and any organization subject to SOC 2 that enforces MFA.
Recommended Actions
- Update your security‑awareness program to include simulated phishing that mimics cloud‑hosted AitM attacks and tracks MFA capture attempts.
- Map the phishing flow to SOC 2 CC6.1/CC6.2 controls, capture training completion and test results as continuous audit evidence.
- Conduct a vendor‑risk review of any PaaS services used for public‑facing assets; document mitigation steps (e.g., sub‑domain allow‑lists, CSP headers).
Source: SecureList – Cloud Platforms in Phishing
Technical Notes — The attack chain relies on legitimate cloud CDN infrastructure to hide the malicious origin, uses HTML/JavaScript to hijack the browser session, and captures one‑time MFA codes in real time. No specific CVE is involved; the vector is a social‑engineering and mis‑use of trusted services. Source: SecureList – Cloud Platforms in Phishing