Hackers Abusing Legitimate Cloud and CDN Platforms to Host Phishing Kits

The report describes a trend where threat actors host phishing kits on trusted cloud and CDN services (Azure Blob, Firebase Storage, CloudFront, Google Sites) to evade domain-reputation based defenses; researchers observed kits such as Tycoon, Sneaky2FA, and EvilProxy using these platforms to deliver credential-harvesting pages and provided related IOCs while recommending behavioral detection and targeted threat intelligence lookups for cloud-hosted abuse.