Phishing Campaigns Exploit Vercel’s Free Hosting Platform in Cyberattacks
Cybercriminals are increasingly abusing Vercel’s free hosting platform as a critical component of phishing campaigns, leveraging its infrastructure to launch sophisticated attacks. These campaigns target organizations by distributing malicious links and payloads under the guise of legitimate services, making detection more challenging.
The attacks highlight a growing trend where threat actors exploit widely trusted cloud and hosting services to bypass traditional security measures. Security researchers have identified three distinct phishing campaigns utilizing Vercel, each designed to evade email filters and trick users into disclosing credentials or downloading malware.
While the exact timeline of these campaigns remains unclear, the abuse of Vercel’s platform underscores the need for layered email security controls, including advanced threat detection, real-time monitoring, and user awareness training. Organizations relying on Microsoft 365 or Google Workspace common targets for such attacks are particularly vulnerable if proper safeguards are not in place.
In a separate but related development, Google patched its fifth Chrome zero-day vulnerability of 2026, as ransomware attacks continued to disrupt critical sectors, including schools, ports, and manufacturing. The rapid succession of zero-day exploits and ransomware incidents reflects an escalating threat landscape, where attackers exploit unpatched systems and misconfigured cloud services to maximize impact.
The convergence of these threats phishing via trusted platforms and unpatched vulnerabilities reinforces the importance of proactive security measures, including robust patch management, virtual machine (VM) backups (particularly for VMware environments), and comprehensive email security strategies. As businesses increasingly migrate workloads to virtualized infrastructure, securing these environments remains a top priority.
Source: https://www.kaseya.com/?post_type=post&p=28864
Google TPRM report: https://www.rankiteo.com/company/googlecloudsecurity
Vercel TPRM report: https://www.rankiteo.com/company/vercel
VMware TPRM report: https://www.rankiteo.com/company/vmware
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security
"id": "vervmwgoomic1781677737",
"linkid": "vercel, vmware, googlecloudsecurity, microsoft-security",
"type": "Vulnerability",
"date": "6/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'name': 'Organizations using Microsoft 365 or Google '
'Workspace',
'type': 'Businesses'}],
'attack_vector': 'Abuse of trusted cloud/hosting service (Vercel)',
'data_breach': {'sensitivity_of_data': 'High (credentials)',
'type_of_data_compromised': 'Credentials, Malware payloads'},
'description': 'Cybercriminals are increasingly abusing Vercel’s free hosting '
'platform as a critical component of phishing campaigns, '
'leveraging its infrastructure to launch sophisticated '
'attacks. These campaigns target organizations by distributing '
'malicious links and payloads under the guise of legitimate '
'services, making detection more challenging. Security '
'researchers have identified three distinct phishing campaigns '
'utilizing Vercel, each designed to evade email filters and '
'trick users into disclosing credentials or downloading '
'malware. The abuse of Vercel’s platform underscores the need '
'for layered email security controls, including advanced '
'threat detection, real-time monitoring, and user awareness '
'training.',
'impact': {'identity_theft_risk': 'High'},
'lessons_learned': 'The abuse of trusted cloud/hosting services like Vercel '
'highlights the need for layered email security controls, '
'including advanced threat detection, real-time '
'monitoring, and user awareness training.',
'post_incident_analysis': {'corrective_actions': 'Implement advanced threat '
'detection, real-time '
'monitoring, user awareness '
'training, and robust patch '
'management',
'root_causes': 'Exploitation of trusted '
'cloud/hosting services (Vercel), '
'lack of layered email security '
'controls'},
'recommendations': ['Implement layered email security controls (advanced '
'threat detection, real-time monitoring)',
'Conduct user awareness training',
'Enforce robust patch management (e.g., Google Chrome '
'zero-day patches)',
'Secure virtualized infrastructure (VM backups for VMware '
'environments)',
'Adopt comprehensive email security strategies'],
'response': {'enhanced_monitoring': 'Recommended (real-time monitoring)'},
'title': 'Phishing Campaigns Exploit Vercel’s Free Hosting Platform in '
'Cyberattacks',
'type': 'Phishing'}