Ngrok Misused By Hackers For New Phishing Wave

Cyble observed an uptick in phishing campaigns abusing the ngrok tunnelling service to expose locally hosted phishing pages on random ngrok subdomains, enabling attackers to bypass NAT/firewall protections and capture credentials, OTPs, and financial data; the report includes attack steps, example ngrok IOCs, evidence of tool-sharing in cybercrime forums, and mitigation recommendations.