Cloud Infrastructure has become a key component of how modern-day companies operate as it provides scalability, reliability, and collaboration. However, this also provides threat actors with the capabilities to carry out sophisticated large-scale phishing attacks by abusing Cloud platforms to host malicious content and phishing kits which has driven higher successful phishing rates.
Over the recent months, there has been a continued sharp increase observed in the number of phishing pages being hosted on legitimate cloud infrastructure. This shows a significant shift in threat actor behaviour and within the phishing ecosystem, which primarily used to rely upon disposable dynamically generated algorithm (DGA) domains and bulletproof hosting providers to facilitate phishing campaigns. Threat actors are exploiting human trust and spinning infrastructure up on trusted platforms such as Amazon Web Services (AWS), Microsoft Azure, Google Firebase and Cloudflare.
The shift in threat actor infrastructure no longer relies on “Is this a legitimate domain” but is now behavioural based. Modern Phishing-as-a-Service (PhaaS) kits have lowered the barrier of entry for threat actors allowing for sophisticated large-scale campaigns to be launched with high success rates. As a result, a surge in Initial Access Broker (IAB) activity has occurred, in turn fueling Ransomware-as-a-Service (RaaS) groups and broadening the threat landscape. PhaaS kits such as Tycoon2FA, Sneaky2FA and EvilProxy are among the most active that have been observed in the wild. PhaaS kits hosted on cloud infrastructure include multiple layers of built-in mechanisms to evade detection such as being able to pass SPF, DKIM, DMARC and CompAuth checks, short-lived domains, reverse proxy capabilities, and anti-sandboxing techniques such as CAPTCHA, time-based checks and user agent filtering.
Common Cloud Infrastructure Domains Abused
- hxxps://pages[.]dev
- hxxps://worker[.]dev
- hxxps://blob[.]core[.]windows[.]net
- hxxps://s3[.]amazonaws[.]com
- hxxps://storage[.]googleapis[.]com
- hxxps://storage[.]cloud[.]google[.]com
- hxxps://firebaseapp[.]com
- hxxps://railway[.]app
Mitigations for Cloud Infrastructure Phishing
- Enforce Phishing Resistant MFA (Passkeys or FIDO2)
- Enforce Strict Sign-In requirements (Managed/Compliant devices and Geo-location restrictions)
- Enable Email Content Inspection on security appliances
- Security Awareness Training for all staff