Abuse of Cloud-Native Infrastructure in Modern Phishing Campaigns – CYFIRMA

MITRE Techniques

• [T1583.004] Acquire Infrastructure: Server – Attackers registered free-tier cloud accounts and used provider infrastructure to send phishing mail and host components (‘they registered a free-tier account and configured it to dispatch phishing emails through the provider’s own outbound mail infrastructure’).
• [T1584] Compromise Infrastructure – A compromised government website was used as part of spear-phishing delivery and trusted infrastructure abuse (‘spear-phishing delivery through a compromised government website’).
• [T1566.001] Phishing: Spear phishing Attachment – Victims received QR codes embedded in PDF attachments as lure delivery (‘a QR code embedded in a PDF attachment’).
• [T1566.002] Phishing: Spear phishing Link – Victims were directed through links to cloud-hosted phishing pages and intermediary services (‘a link to an apparently benign intermediary’).
• [T1059.007] Command and Scripting Interpreter: JavaScript – A minimal JavaScript loader decoded and rendered a phishing page in memory (‘The loader uses standard browser APIs to Base64-decode a bundled HTML payload’).
• [T1027] Obfuscated Files or Information – The attack chain hid content through encoded payloads, blob navigation, and layered redirects (‘Base64-decode a bundled HTML payload’, ‘layered: a legitimate form submission service resolved to a Blob-hosted redirect’).
• [T1078.004] Valid Accounts: Cloud Accounts – Threat actors relied on legitimate cloud identities, tokens, and signed-in sessions (‘the attacker’s access token looked identical to the legitimate user’s’).
• [T1556] Modify Authentication Process – Adversary-in-the-middle proxying intercepted real authentication flows and session cookies (‘A reverse proxy is positioned between the victim and the legitimate authentication endpoint’).
• [T1528] Steal Application Access Token – OAuth device code abuse and session theft were used to obtain persistent access tokens (‘the victim’s authentication at that portal issues a valid access and refresh token directly to the attacker’s registered application’).
• [T1557] Adversary-in-the-Middle – The proxy relayed a genuine MFA login and captured the resulting session cookie (‘The victim completes a genuine MFA-verified sign-in. The proxy captures the resulting session cookie’).
• [T1114.003] Email Collection: Email Forwarding Rule – Attackers created forwarding and silent deletion rules for persistence (‘the attacker created inbox rules within minutes of obtaining access’).
• [T1119] Automated Collection – The campaign used automated workflows and scripted interaction to gather user information (‘automated platform notifications’, ‘interaction pipeline’).
• [T1102] Web Service – Command-and-control and phishing workflows were embedded in legitimate cloud and SaaS services (‘legitimate consumer calendar API calls’).
• [T1567] Exfiltration Over Web Service – Data and operational telemetry were exposed through cloud services and APIs (’embedding operational instructions inside routine API calls’).