Phishers are hijacking legitimate cloud infrastructure

(securelist.com)

19 points | by lschueller 2 hours ago ago

5 comments

  • illithid0 25 minutes ago

    Red teamer here. We've been doing this for a long time for all kinds of evasion. Storing payloads in Azure blob storage, for example, is an amazingly effective way to deliver malware through network filtering controls.

    You can look at more of the capabilities we like to use at the LOTS project: https://lots-project.com/

  • Bender 26 minutes ago

    Their pie chart almost looks like part of my local DNS configuration. I have not yet blocked github.io or azure however. I built this Unbound DNS configuration file from all the AI submissions in the event I accidentally click on one before noticing the domain.

        local-zone:     "workers.dev." always_null
        local-zone:     "pages.dev." always_null
        local-zone:     "vercel.app." always_null
        local-zone:     "netlify.app." always_null
        local-zone:     "dweb.link." always_null
        local-zone:     "ipfs.io." always_null
    
        dig +short test.vercel.app
        0.0.0.0
    • embedding-shape 20 minutes ago

      > drweb.link."

      Considering you have ipfs.io on that list, I wonder if this is a typo for dweb.link actually?

      • Bender 17 minutes ago

        That is a typo, I will fix it. Thankyou!

  • inigyou 14 minutes ago

    I bet they have an easier time getting past your blacklist filters than non-phishers.