Using StackBlitz to Launch Phishing Campaigns

Zscaler ThreatLabz observed multiple active phishing campaigns that host credential-harvesting pages on StackBlitz by abusing its preboot/CachedFetch functionality to deliver server-side pages as JSON and redirect victims to fake login portals (Outlook, OneDrive/Office365, Gmail, Yahoo, etc.). The report documents two spam delivery methods (OneDrive-themed lures), shows traffic and source code analysis, and lists many StackBlitz subdomains and additional malicious domains as IOCs to aid detection and blocking.