Google Cloud & Cloudflare Missed 3-Year Phishing Campaign

An industrial-scale phishing campaign exploited Google Cloud and Cloudflare infrastructure and operated in plain sight for more than three years, targeting Fortune 500 companies and siphoning millions in potential revenue.

Deep Specter Research’s investigation reveals that phishing sites used cloaks of high-trust, expired domains to present clean content to bots while serving illicit pages to human visitors, with a clone approach that matched brands to industry keywords and even included military sites with defence contractors.

The phishing infrastructure grew steadily from 34 hosts in 2021 to nearly 2,800 by mid-2025, peaking at 33,890 observations in March 2025, with over 48,000 hosts involved across more than 80 infrastructure clusters. Eight “management” hosts directed 78 regular clusters, and only 1,000 of the 48,000 hosts supported HTTPS.

Notably, Lockheed Martin was among victims, with its public site cloned and paired with illegal gambling pages under the domain militaryfighterjet[.]com, illustrating the breadth and impact of the operation. Deep Specter Research regards the campaign as a phishing-as-a-service platform, emphasising the need for improved threat detection and prompt action by infrastructure providers.