Cloudflare Workers Used to Steal MFA Sessions

A real multi-stage phishing campaign abused trusted cloud platforms (notably Cloudflare Workers) to make fake login flows look legitimate and to bypass MFA. The attack chained a phishing email, a fake CAPTCHA page on a compromised site, and a browser “pop-up” spoof that captured both credentials and MFA-backed session tokens, then redirected victims to a generic error to reduce suspicion.

Key findings

• Attackers hosted phishing infrastructure on reputable cloud platforms (Cloudflare Workers, Vercel, Netlify, GitHub Pages) to benefit from domain trust, free tiers, and CDN shielding.
• The campaign used a multi-stage flow: phishing email → fake CAPTCHA on a compromised site → Cloudflare Workers subdomain with a real CAPTCHA and a service worker → browser-in-the-browser (BitB) fake window wrapping a proxied Microsoft login.
• The first stage harvested the victim’s email and filtered bots, then redirected to a Cloudflare Workers subdomain.
• The victim’s email address was passed via the URL hash (after “#”) to avoid being sent in normal network requests and reduce detection.
• A service worker was registered to intercept and rewrite traffic, routing Microsoft login requests through an attacker-controlled proxy (AitM).
• The BitB technique displayed a spoofed address bar with a trusted Microsoft URL while intercepting credentials, MFA codes, and session tokens.
• After successful login, the victim was redirected to a generic error (example: “SessionExpired”) to minimize suspicion.
• Telemetry (Aug 2025–Jul 2026) showed heavy abuse of cloud domains, led by pages.dev (24.9%), vercel.app (13.8%), github.io (13.7%), and netlify.app (10.0%).

Who’s being targeted

• Commonly targeted roles: All employees, Executives, Finance, HR, Anyone using Microsoft 365 / webmail / SSO.
• Affected industries: Cross-industry (any organization using cloud-hosted apps and Microsoft login pages).
• Attack channels: email, website.
• Impersonated: Coworker / internal colleague, Cloud-hosted verification page (Cloudflare Workers-hosted content), Microsoft login window (browser-in-the-browser spoof).

Awareness takeaways

• Don’t trust a link just because it’s HTTPS or hosted on a well-known cloud domain; verify the context and destination.
• Treat CAPTCHAs that ask you to type personal data (like your email) as suspicious and stop the flow.
• If a login prompt appears in an unexpected pop-up, close it and navigate to the service manually (type the address yourself).
• For suspected ‘browser-in-the-browser’ tricks, check the real browser address bar at the top of the window (not the pop-up’s fake address bar).

Red flags to watch for

• Unexpected document-review request pushing you to click a link
• CAPTCHA page asks for an email address (unusual for real CAPTCHAs)
• Redirect chain through unrelated domains before showing any real content
• You land on an unexpected *.workers.dev page
• The page carries your email in the URL after a “#” (hash)
• Unusual background activity that precedes a login prompt
• Login appears inside a page-rendered pop-up rather than a real browser sign-in flow
• The pop-up shows a ‘trusted’ URL, but the real browser address bar still shows a different domain
• After login, you are redirected to a generic error page (e.g., SessionExpired)