Legitimate SaaS Platforms Being Used to Host Phishing Attacks
Summary: Cybercriminals are increasingly hosting phishing pages on legitimate SaaS platforms such as website builders, form builders, and link-hosting sites, rather than building pages from scratch, because URLs on legitimate domains are harder for phishing detection engines to flag. Palo Alto Networks analyzed URLs detected by its Advanced URL Filtering service from January 2020 to June 2022 and found that newly detected phishing URLs hosted on legitimate SaaS platforms increased over 1100% between June 2021 and June 2022.
What you should know: An 1100% year-over-year rise in phishing URLs on legitimate SaaS domains means a URL that looks trustworthy is no longer evidence of anything, and attackers are deliberately choosing niche platforms that likely have fewer abuse-prevention resources so their pages stay live longer.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026