Phillip Roberts | 5 August 2026

Over the past two weeks, Fortian has observed a significant increase in campaigns abusing legitimate application hosting platforms - Vercel, Cloudflare Workers, and Netlify - to stage credential harvesting pages and malware loaders. The platforms themselves aren't compromised. Attackers are simply deploying malicious content using the same free-tier accounts your developers might use. A common theme between these campaigns was that they are all distributed via phishing emails that abuse tax-themed lures.

This works because these platforms serve content from trusted, clean-reputation domains (vercel.app, workers.dev, netlify.app) that bypass URL reputation filters and domain block lists.

Here's what we found across three distinct campaigns in July:

1. AI-generated JavaScript loader delivering LogMeIn RMM. Tax-themed phishing directs victims to a Vercel page displaying a fake PDF. Accessing the "document" downloads a password-protected zip containing a JS loader. The JavaScript was entirely AI-generated, identifiable by its verbose inline comments and emoji-laden code annotations. The script downloads LogMeIn RMM in the background while redirecting the user to the legitimate ATO homepage as a decoy.
2. UPS impersonation distributing ScreenConnect RMM. Phishing emails with subject "Important: Your Shipment Has Arrived" direct victims to a Vercel-hosted page that downloads a VBS script disguised as an Adobe Flash updater. The script fetches and installs ScreenConnect, giving the attacker persistent remote access to the machine. Delivery to installer takes two clicks. No commodity malware is used, allowing the payload to bypass EDR detections.
3. ATO credential harvesting at scale. Fake myGov notifications link to Vercel-hosted pages cloning the Australian Taxation Office login portal. This campaign is broad and indiscriminate, targeting enterprise mailboxes across industries to compromise personal ATO accounts during tax season. The lure subject was consistently "Inbox notification—New message."

Common thread: Every campaign uses tax-season lures, abuses vercel.app subdomains for hosting, and delivers either credential harvesting or RMM tool deployment. The operational objectives differ but the infrastructure playbook is identical.

The shift here isn't the phishing technique - it's the infrastructure choice. These platforms offer instant deployment, auto-TLS, trusted domains, and no identity verification on free tiers. Attackers are treating them as disposable staging infrastructure that inherits the reputation of the platform itself. The tool of choice in most campaigns are legitimate RMM tools that will not be flagged by your EDR. Detection relies on custom, behavioural-based analytics rules and threat hunting.

We already detect and action these across our managed environments. If your organisation relies on URL reputation alone to filter threats or EDR tools to block the payloads, this is the gap.

Hunt for This in Your Environment

// Detect clicks to application hosting platforms
CommonSecurityLog
| where TimeGenerated >= ago(90d)
| where RequestURL has_any ("vercel.app", "workers.dev", "netlify.app", "pages.dev")
| where not(RequestURL has_any ("your-legitimate-apps-here")) // Tune for your environment
| summarize count(), dcount(SourceUserName), make_set(SourceUserName) by DestinationHostName
| order by dcount_SourceUserName desc

// Hunt for RMM tool downloads from unusual initiating processes
DeviceFileEvents
| where TimeGenerated >= ago(90d)
| where FileName has_any ("sc.msi", "LogMeInResolve", "ScreenConnect", "ConnectWise")
| where InitiatingProcessFileName has_any ("cmd.exe", "wscript.exe", "cscript.exe", "powershell.exe", "curl.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine

// Hunt for URL click events
UrlClickEvents
| where TimeGenerated >= ago(90d)
| where Url has_any("vercel.app", "workers.dev", "netlify.app", "pages.dev")
| project-reorder TimeGenerated, AccountUpn, Url, UrlChain

Indicators of Compromise

Phishing infrastructure:

• ups-murex.vercel[.]app
• upss-vert.vercel[.]app/doc/sc.msi
• statementaccountshared09334.vercel[.]app
• statements-summary0172206194.vercel[.]app - ATO fake PDF / JS loader
• summary-statement-000280154492.vercel[.]app
• fileshraedocumentsharedrev.vercel[.]app
• sunlighterssummers.vercel[.]app

File hash:

• b64572b3df55930638db3226d9213d5e55c7165d28ae75782cf72967c2aeffa0

Sender addresses:

• admin@learnstax[.]com
• support@smartdebtadvisors[.]co[.]za
• sale@quickemail15[.]org