Full Report
We cover a cloud-based AitM attack scenario leveraging service workers and Ultraviolet, and provide detailed phishing hosting statistics across platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS.
Analysis Summary
# Tool/Technique: Cloud-Based AitM Phishing via Ultraviolet & Service Workers
## Overview
This technique involves an Adversary-in-the-Middle (AitM) attack architecture hosted on legitimate cloud platforms (PaaS). It utilizes the **Ultraviolet** web proxy framework and browser **Service Workers** to intercept user credentials and session tokens in real-time. By leveraging reputable domains like Cloudflare Workers or Vercel, attackers bypass traditional reputation-based URL filters.
## Technical Details
- **Type**: Tool / Attack Technique
- **Platform**: Web Browsers (Cross-platform), Cloud Hosting (Cloudflare Workers, Vercel, Netlify, GitHub Pages, IPFS)
- **Capabilities**: Credential harvesting, session token theft (AitM), bypass of Multi-Factor Authentication (MFA), evasion of automated scanners.
- **First Seen**: Increasing prevalence noted in late 2023–2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1539 - Steal Web Session Cookie]
- **[TA0005 - Defense Evasion]**
- [T1564.012 - Provide Sophisticated Phishing Infrastructure]
- [T1553.003 - Subvert Trust Controls: SIP and Trust Provider Referrals]
## Functionality
### Core Capabilities
- **Proxy-based Interception**: Acts as a transparent proxy between the victim and the legitimate login service (e.g., Microsoft 365).
- **Service Worker Exploitation**: Uses Service Workers to intercept fetch requests, allowing the attacker to modify site content or capture headers before they leave the browser.
- **Cloud Hosting Abuse**: Utilizes subdomains of `workers.dev`, `vercel.app`, and `netlify.app` to inherit the high reputation of the parent domain.
### Advanced Features
- **Ultraviolet Framework Integration**: Employs the Ultraviolet web proxy to bypass internet censorship or security filters by obfuscating the destination URL and rewriting client-side requests.
- **Dynamic Content Injection**: Real-time modification of the legitimate page to insert malicious scripts or hidden fields.
- **MFA Bypass**: Since the session is proxied in real-time, the attacker captures the session cookie immediately after the victim completes the MFA prompt.
## Indicators of Compromise
- **Network Indicators**:
- `*.[worker-name].workers[.]dev`
- `*.[project-name].vercel[.]app`
- `*.[site-name].netlify[.]app`
- `*.[account].github[.]io`
- `ipfs[.]io/ipfs/[CID]`
- **Behavioral Indicators**:
- Registration of unexpected Service Workers from unauthorized domains.
- Unusual websocket connections originating from a legitimate-looking login page.
- Redirect chains moving from a cloud-hosted landing page to a complex proxy URL.
## Associated Threat Actors
- **Tactical Phishing Operations**: Generally used by sophisticated e-crime groups and IABs (Initial Access Brokers) targeting corporate credentials.
## Detection Methods
- **Behavioral Detection**: Monitor for "Service Worker Registration" events in browser logs, especially those occurring on domains not owned by the organization.
- **Network Analysis**: Inspect for high-entropy subdomains on PaaS platforms or use of WebSockets (WS/WSS) to unconventional endpoints during authentication.
- **Heuristic Scanning**: Identify JavaScript obfuscation patterns consistent with the Ultraviolet proxy framework (e.g., specific encoding of URLs in the client-side script).
## Mitigation Strategies
- **Prevention Measures**: Implement FIDO2/WebAuthn-based hardware security keys, which are resistant to AitM attacks because they bind the credential to the specific origin.
- **Hardening recommendations**:
- Use Content Security Policy (CSP) headers to restrict where scripts can be loaded from and where Service Workers can be registered.
- Implement tenant restrictions for cloud services (e.g., Office 365 Tenant Restrictions) to prevent logging into unauthorized instances.
## Related Tools/Techniques
- **Evilginx2 / Muraena**: Similar AitM frameworks but typically require dedicated VPS hosting rather than serverless cloud functions.
- **Phishing-as-a-Service (PhaaS)**: Many platforms now integrate cloud-based hosting as a standard feature.