August 5, 2026
Your scam, now cloud-powered
Phishers are hijacking legitimate cloud infrastructure
Scammers are hiding on trusted websites and commenters are absolutely furious
TLDR: Scammers are increasingly putting fake login pages on trusted web platforms, making them harder to spot and harder to block without affecting real sites. Commenters were split between shrugging that this is nothing new and raging that big cloud companies profit while doing too little to stop it.
The big shocker here isn’t just that phishing gangs are building scam pages on popular cloud services like Cloudflare, Vercel, Netlify, GitHub Pages, and IPFS — it’s that the comments turned into a full-on "we told you so" riot. The article explains how crooks are abusing well-known web platforms because they look trustworthy, are cheap or free to use, and are hard to block without also breaking tons of innocent sites. In plain English: the bad guys are renting space in the same fancy neighborhood as normal developers, and security teams can’t just bulldoze the block.
That sent the community straight into debate mode. One camp was grimly unimpressed: a self-described red teamer basically said, yes, attackers using trusted services to sneak past defenses is old news, even dropping a link to the playbook. Another group was more enraged than surprised, accusing cloud companies of not being “hijacked” at all but “happily hosting” phishers because stronger identity checks might hurt business. Ouch.
And then came the nerd humor. One commenter joked the chart of abused services looked like their home DNS blocklist, casually sharing a setup that blackholes shady subdomains before they load. Another jabbed that phishers probably get through blacklists more easily than regular users. The overall mood? Equal parts dark comedy, security fatigue, and a very loud argument over whether this is clever criminal abuse — or a business model problem hiding in plain sight.
Key Points
- •The article says phishing operators are increasingly hosting scam infrastructure on legitimate cloud and decentralized platforms such as Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS.
- •It identifies platform reputation, free-tier access, limited identity verification, and CDN-backed anonymity as key reasons attackers choose these services.
- •Shared subdomains on major platforms make domain-based blocking difficult because blocking parent domains would also affect many legitimate users.
- •The article details a multi-stage AitM phishing campaign in which a compromised website first serves a fake CAPTCHA page to harvest email addresses and filter bots.
- •In the example attack, victims are redirected to workers.dev pages where URL hashes, CAPTCHA checks, and reverse-proxy setup are used to advance credential and MFA-session theft.