A phishing campaign documented by Kaspersky turns an ordinary browser feature into a credential-stealing proxy, letting attackers walk away with Microsoft 365 session tokens even after the victim clears multi-factor authentication.
The feature is the service worker — a background JavaScript file that browsers install to make progressive web apps load faster and work offline. Because browsers treat it as standard site functionality, any HTTPS page can register one without showing the user a prompt. In this campaign, the silent install is the entire attack.
Kaspersky researcher Olga Altukhova traced the operation across three separate pages. The first is a fake CAPTCHA on a hacked legitimate website that asks the visitor to type an email address before continuing — a step no real CAPTCHA requires. That address is then passed forward in the URL hash, the portion after the # character, which browsers never send to a server. The email stays invisible to network monitoring tools for the rest of the chain.
Stage two lands on a free workers.dev subdomain, where the victim solves a genuine CAPTCHA to filter out security sandboxes. Behind it, the page registers a service worker with root scope, giving it the ability to intercept every request the tab makes. It then loads Ultraviolet, an open-source web proxy library, which rewrites all links and forms so traffic bound for Microsoft routes through the attacker's server first.
The final page renders a browser-in-the-browser popup — a fake window drawn inside the page, complete with controls and an address bar reading login.microsoftonline.com. An iframe inside it loads the real Microsoft sign-in form through the proxy. Credentials and MFA codes go straight to the operator, who then bounces the victim to a bland "SessionExpired" error so the failed login looks like a glitch.
Between August 2025 and July 2026, Kaspersky blocked 224,984 unique third-level domains hosting phishing content on cloud and decentralized services, and neutralized over 390,000 pages in total. Cloudflare Pages (pages.dev) accounted for 24.9% of phishing links, followed by Vercel at 13.8% and GitHub Pages at 13.7%. IPFS gateways dweb.link and ipfs.io took a combined 13.1%, and their content persistence means blocking one gateway does not remove the page.
Free tiers with no identity checks, automatic SSL, and shared parent domains that defenders cannot blocklist without breaking legitimate projects make these platforms hard to police. Kaspersky's advice: check the address bar at the very top of the real browser window, treat any CAPTCHA asking for personal data as hostile, and never type credentials into a pop-up you did not open yourself.