The core of these campaigns is a sophisticated Adversary-in-the-Middle (AitM) approach that uses browser-side service workers to intercept network requests. By utilizing the legitimate Ultraviolet proxy library, the phishing pages dynamically rewrite traffic in real-time, effectively bypassing traditional proxy-based security controls. This approach allows attackers to harvest login credentials and MFA tokens while the victim interacts with what appears to be a legitimate, HTTPS-secured website. The use of URL hash fragments to pass sensitive data between attack stages ensures that malicious parameters remain hidden from standard network-based detection systems.

Attack Chain

1. Attackers deliver a phishing email containing a link to a compromised legitimate website.
2. The compromised website acts as a disposable relay to capture the victim's email address via a fake CAPTCHA.
3. The victim is redirected to a cloud-hosted subdomain (e.g., workers.dev) with the email address embedded in the URL hash.
4. The phishing page presents a genuine CAPTCHA challenge to confirm the victim is not a bot.
5. Upon success, a malicious service worker is registered in the browser to intercept all outgoing network requests.
6. The service worker injects the Ultraviolet library to create a transparent proxy that rewrites login forms.
7. The user enters credentials and MFA tokens, which are captured and proxied by the attacker's infrastructure.
8. The attacker uses the captured credentials and session tokens to gain unauthorized access to the target's account.

Impact

Successful attacks result in full credential and MFA token compromise, leading to account takeover. Because these campaigns reside on reputable cloud subdomains, they successfully bypass many traditional reputation-based security filters. The infrastructure allows attackers to bypass MFA mechanisms by capturing session cookies, significantly increasing the risk to enterprise authentication environments.

Recommendation

• Implement content-based analysis for web traffic to identify malicious JavaScript (e.g., unauthorized service worker registration) rather than relying solely on domain reputation.
• Monitor browser activity for the suspicious registration of service workers on domains that are not part of the organization's sanctioned enterprise application suite.
• Deploy FIDO2/WebAuthn-based phishing-resistant MFA, which inherently mitigates AitM credential harvesting attacks.
• Educate users on the risks of interacting with links that redirect through reputable cloud platforms (like workers.dev) when prompted for sensitive corporate credentials.
• Review proxy logs for traffic patterns associated with known browser-based proxy libraries like Ultraviolet.