Phishers are hijacking legitimate cloud infrastructure

3 comments

• illithid030 minutes ago
  Red teamer here. We&#x27;ve been doing this for a long time for all kinds of evasion. Storing payloads in Azure blob storage, for example, is an amazingly effective way to deliver malware through network filtering controls.<p>You can look at more of the capabilities we like to use at the LOTS project: <a href="https:&#x2F;&#x2F;lots-project.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lots-project.com&#x2F;</a>
• Bender31 minutes ago
  Their pie chart almost looks like part of my local DNS configuration. I have not yet blocked github.io or azure however. I built this Unbound DNS configuration file from all the AI submissions in the event I accidentally click on one before noticing the domain.<p><pre><code> local-zone: &quot;workers.dev.&quot; always_null local-zone: &quot;pages.dev.&quot; always_null local-zone: &quot;vercel.app.&quot; always_null local-zone: &quot;netlify.app.&quot; always_null local-zone: &quot;dweb.link.&quot; always_null local-zone: &quot;ipfs.io.&quot; always_null dig +short test.vercel.app 0.0.0.0</code></pre>
  • embedding-shape24 minutes ago
    &gt; drweb.link.&quot;<p>Considering you have ipfs.io on that list, I wonder if this is a typo for dweb.link actually?
    • Bender22 minutes ago
      That is a typo, I will fix it. Thankyou!
• inigyou18 minutes ago
  I bet they have an easier time getting past your blacklist filters than non-phishers.