CYFIRMA Details Phishing Campaigns Abusing Trusted Cloud Infrastructure
Summary
CYFIRMA describes Trusted Infrastructure Phishing campaigns abusing legitimate cloud services for delivery, hosting, token theft and persistence, including browser-memory phishing and OAuth device-code abuse, and recommends identity-focused monitoring and stronger than
Key points
- The report describes campaigns using provider-owned email, cloud storage, OAuth flows and SaaS APIs across delivery, hosting, authentication and persistence, often reducing conventional phishing indicators.
- In the BlobPhish campaign, JavaScript Blob APIs render phishing pages in browser memory, limiting network and file-based evidence, according to CYFIRMA.
- The report says adversary-in-the-middle proxying and OAuth device code abuse can capture sessions or tokens despite MFA.
- Reported persistence methods include inbox rules and OAuth refresh tokens; one case study describes command-and-control using legitimate calendar API calls.
- CYFIRMA says more than 340 organizations were affected by device-code campaigns in early 2026.
- A case study found an unauthenticated backend exposing chatbot transcripts, session identifiers and interaction logs; Thai-language inputs and Buddhist Era dates indicated targeting of Thai users.
- Recommendations include phishing-resistant authentication, tighter OAuth application governance, device-code flow restrictions, and monitoring identity, browser and cloud API activity.
Article Details
- Attack Vectors
- Phishing emails sent through legitimate provider-owned workflow and mail infrastructure, impersonating internal notifications and document-sharing requests.
- Phishing pages hosted on Azure Blob Storage, SharePoint, or OneDrive, sometimes reached through layered trusted-service redirects.
- PDF attachments containing QR codes and links that lead to a JavaScript loader, which Base64-decodes HTML and renders a phishing page in a browser Blob URL.
- Adversary-in-the-middle reverse proxies that relay legitimate MFA sign-ins and capture session cookies.
- OAuth 2.0 Device Authorization Grant lures that trick victims into authorizing tokens for an attacker-registered application.
- Post-compromise persistence using inbox forwarding, silent-deletion, and keyword-triggered folder rules.
- Command-and-control instructions embedded in routine calls to legitimate SaaS calendar APIs.
- Defensive Notes
- Use phishing-resistant authentication, such as FIDO2 security keys or platform passkeys, especially for privileged and externally exposed accounts.
- Disable OAuth 2.0 Device Code Flow unless required; otherwise restrict it to known managed devices and approved network locations.
- Govern OAuth application permissions, audit delegated access, revoke unrecognized applications, and require administrator approval for sensitive consent.
- Monitor Entra ID sign-in logs, OAuth consent events, and Microsoft 365 audit trails, including device-code sign-ins from unfamiliar geographies or devices.
- Alert on inbox-rule creation shortly after authentication from a new device or location.
- Correlate browser blob:https:// navigation events with subsequent cloud authentication attempts.
- Restrict anonymous Azure Blob Storage access and audit publicly accessible containers.
- Monitor cloud API behavior, particularly calendar, note-taking, and storage activity, for deviations in timing, frequency, and off-hours use.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]238[.]159[.]149 | Listed as an IP address to block in the article's campaign indicator list. |
| IPV4 | 107[.]191[.]58[.]76 | Listed as an IP address to block in connection with the phishing campaign infrastructure. |
| IPV4 | 20[.]44[.]241[.]109 | Campaign backend environment hosted on Azure Container Apps; the article lists this address to block. |
| IPV4 | 96[.]9[.]125[.]147 | Listed as an IP address to block in the article's campaign indicator list. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe in-memory phishing flow uses a Base64-encoded HTML payload and layered redirects.T1059.007 · JavaScriptA JavaScript loader Base64-decodes an HTML payload and renders it in the victim's browser.T1078.004 · Cloud AccountsAfter obtaining valid cloud tokens or session cookies, attackers access victims' cloud environments using legitimate cloud identities.T1102 · Web ServiceCase Study D describes command-and-control instructions embedded in legitimate consumer calendar API calls.T1114.003 · Email Forwarding RuleAttackers created inbox forwarding rules, including rules that silently deleted messages or routed messages to folders.T1119 · Automated CollectionAutomated workflows and chatbot interactions collected information supplied by phishing victims.T1528 · Steal Application Access TokenOAuth device-code abuse obtains access and refresh tokens for an attacker-registered application.T1557 · Adversary-in-the-MiddleAn adversary-in-the-middle reverse proxy relays a genuine MFA sign-in and captures the resulting session cookie.T1566.001 · Spearphishing AttachmentVictims received PDF attachments containing QR codes that led into phishing link chains.T1566.002 · Spearphishing LinkLures directed victims through links to cloud-hosted phishing pages or intermediary services.T1583.004 · ServerIn Case Study A, the attacker registered a free-tier cloud account and configured it to send phishing emails through the provider's outbound mail infrastructure.T1584 · Compromise InfrastructureCase Study D describes spear-phishing delivery through a compromised government website.
Vendors
CloudflareThe outermost layer was Cloudflare, positioned as the phishing frontend’s protective perimeter.GoogleInfrastructure Phishing (TIP), where attackers abuse legitimate cloud services like Microsoft 365, Google Workspace, Azure Blob Storage, and OAuth flows to make phishing traffic look like normal enterpriseMicrosoftdescribes Trusted Infrastructure Phishing (TIP), where attackers abuse legitimate cloud services like Microsoft 365, Google Workspace, Azure Blob Storage, and OAuth flows to make phishing traffic look like normal
Products
Azure Container AppsThe backend processing environment was a containerized deployment hosted on Azure Container Apps, resolving to 20.44.241.109, a Singapore-region Azure node.Azure Front DoorTraffic passing through Cloudflare was forwarded to Azure Front Door, Microsoft’s globally distributed application delivery service.Google WorkspaceInfrastructure Phishing (TIP), where attackers abuse legitimate cloud services like Microsoft 365, Google Workspace, Azure Blob Storage, and OAuth flows to make phishing traffic look like normal enterprise activity.Microsoft 365 Apps for Enterprisedescribes Trusted Infrastructure Phishing (TIP), where attackers abuse legitimate cloud services like Microsoft 365, Google Workspace, Azure Blob Storage, and OAuth flows to make phishing traffic look like normalMicrosoft Azure Blob Storage(TIP), where attackers abuse legitimate cloud services like Microsoft 365, Google Workspace, Azure Blob Storage, and OAuth flows to make phishing traffic look like normal enterprise activity.Microsoft Entra IDEnable Continuous Access Evaluation in Microsoft Entra ID to reduce the viable lifetime of stolen tokens through near-real-time revocation when impossible travel, IP change, or elevated user risk is detected.Microsoft OneDrive[Cloud Storage / Hosting] Public cloud object storage used for phishing stages – Azure Blob Storage containers, OneDrive-hosted HTML documentsMicrosoft SharePoint[HTTP Request] Suspicious SharePoint editing request from outside expected scope – POST /_layouts/15/ToolPane.aspx?DisplayMode=EditTeamsThe attacker captures the resulting tokens, which provide full access to email, calendar, Teams, SharePoint, and OneDrive, often for the full refresh token lifetime.
Tools
Countries
Industries
Financial ServicesThis campaign illustrates TIP targeting technology, manufacturing, and financial services organizations across North America.Government[T1584] Compromise Infrastructure – A compromised government website was used as part of spear-phishing delivery and trusted infrastructure abuse (‘spear-phishing delivery through a compromised government website’).ManufacturingThe manufacturing sector bore the highest concentration of targeting, consistent with patterns observed across multiple campaigns where operational data is a priority objective.TechnologyThis campaign illustrates TIP targeting technology, manufacturing, and financial services organizations across North America.TelecommunicationsThe identified victims are across North America, Western Europe, Asia-Pacific, and the Middle East across finance, manufacturing, government, transportation, and telecommunications sectors.TransportationThe identified victims are across North America, Western Europe, Asia-Pacific, and the Middle East across finance, manufacturing, government, transportation, and telecommunications sectors.