Threat Actors Abuse Trusted Cloud and Ad Platforms for Multi-Stage Phishing and Scam Delivery

Threat actors are increasingly using trusted platforms—including cloud hosting and major ad networks—to deliver multi-stage phishing and scam campaigns that evade traditional URL and domain reputation controls. Recent activity includes a three-step malvertising chain delivered via Facebook paid ads that redirects victims through a decoy site (e.g., a fake Italian restaurant page) before landing on a tech support scam (TSS) kit hosted on Microsoft Azure infrastructure (including web.core.windows.net). Researchers reported rapid infrastructure churn, with 100+ domains rotated in seven days, and targeting focused on U.S. users with activity concentrated on weekdays.

Parallel enterprise-focused campaigns are hosting phishing infrastructure on Microsoft Azure Blob Storage, Google Firebase, and AWS CloudFront, using redirect chains, CAPTCHA gates, and QR codes to bypass automated analysis and email defenses. Analysis highlighted the use of Adversary-in-the-Middle (AiTM) phishing-as-a-service kits—Tycoon2FA, Sneaky2FA, and EvilProxy—to steal credentials and session tokens even when MFA is enabled. Separately, researchers documented a “clean email” approach to steal Dropbox credentials: benign-looking procurement-themed emails deliver PDF attachments that hide clickable elements (e.g., via AcroForms and FlateDecode), which then route victims to a second-stage file hosted on Vercel Blob and ultimately to a fake Dropbox login page that captures credentials and collects victim telemetry (IP address, location, and device details).