Phishers use Cloudflare Workers and GitHub Pages to bypass MFA
Kaspersky discovered an adversary‑in‑the‑middle attack that runs on serverless platforms—Cloudflare Workers, Vercel, Netlify, GitHub Pages and IPFS—using service workers and the Ultraviolet proxy to intercept credentials and MFA tokens. By hiding malicious code behind reputable cloud domains, attackers evade detection and make blocking impossible, exposing users to credential theft even with 2FA.