UK security researchers are warning of a rising trend in phishing campaigns built on Vercel’s platform, with Cofense reporting a growing number of attacks centred on v0[.]dev, a GenAI tool from web development firm Vercel. The firm said the AI tool is used to create convincing sign-in pages that mimic real brands, and that threat actors can generate a functional malicious site with a few text prompts.
Cofense noted that Vercel’s pro tier starts at around $20 per month and provides hosting, which helps attackers avoid their own phishing infrastructure, while content can be recreated quickly if a site is taken down. The report also highlights that the GenAI model adapts with user input and that Vercel’s cloud hosting facilitates rapid creation and teardown of pages, sometimes enabling one minimally skilled actor to manage multiple campaigns.
Integration with Telegram, AWS, Stripe and xAI offers additional options for would-be attackers, according to Cofense, which also pointed to campaigns featuring Microsoft landing pages, Spotify emails and fake job postings for brands such as Adidas, Ferrari, Louis Vuitton and Nike. According to Cofense, abuse of Vercel has increased significantly over time, though other legitimate platforms are used as well.