Manual brand impersonation takedowns fail because attackers move faster than ticket-based abuse reports can resolve — phishing pages and fake executive profiles often do their damage within hours of going live, while manual removal can take days. A managed takedown program pairs continuous, verified monitoring with pre-authorized removal (in-certain cases), cutting the exposure window from days to hours. This matters most for consulting and professional services firms, where a spoofed domain or fake executive profile can compromise the client trust the business is built on.

How UNC3753 targeted US professional services firms in 2026

Between January and May of 2026, Google's Mandiant threat intelligence team tracked a financially motivated extortion campaign — attributed to a group known as UNC3753, or "Luna Moth," or "Silent Ransom Group" — working its way through dozens of professional, legal, and financial services organizations across the United States. The approach was almost old-fashioned. A benign-looking email about a data migration or an unpaid invoice, a follow-up phone call from someone posing as IT support, and a request to install "remote monitoring" software to fix the problem. No exploit. No malware dropped on day one. Just a firm's own trust in its brand and its people, turned against it.

It's a useful — if unsettling — reminder of why brand and executive impersonation isn't a side issue for professional services firms. It's often the entry point.

How much does phishing and impersonation actually cost US businesses

The scale of the problem, in dollar terms, is no longer subtle. The FBI's Internet Crime Complaint Center logged just over one million complaints in 2025 — the highest volume in the program's history — with phishing and spoofing making up roughly a fifth of all reports. Losses tied to phishing alone roughly tripled year-over-year, and business email compromise, which almost always starts with an attacker impersonating someone the victim trusts, accounted for over $3 billion in reported losses on its own. The mechanics of that damage matter too: the overwhelming majority of BEC losses move through wire transfer or ACH, rails that are fast, largely irreversible, and unforgiving of a slow response.

Put those two facts together and a pattern emerges. Impersonation attacks — of a brand, a partner, an executive, a vendor invoice — aren't rare or exotic. They're the default opening move. And once the fraudulent domain, profile, or listing is live, the clock the defender is racing isn't measured in days. It's measured in hours, sometimes less, before money moves or credentials are harvested.

Why are consulting and professional services firms specifically targeted?

Professional services firms occupy a strange position in the threat landscape. They're rarely the most technically fortified target, but they're consistently one of the most valuable ones. A consulting firm doesn't just protect its own data — it holds engagement records, financial models, and confidential strategy documents belonging to dozens of clients across industries. About 29% of U.S. law firms reported having experienced a security breach at some point, according to the ABA's most recent Legal Technology Survey — up from 25% just two years earlier. The same dynamic applies to consultancies. The firm is a single point of entry into a much larger web of client relationships.

That's precisely the exposure described in Cyble's case study of a U.S. consulting organization managing highly sensitive engagement data, confidential client information, and a large, distributed workforce operating across the country. As the case study describes it, the firm's brand, executives, and digital infrastructure were frequent targets specifically because of the trust clients placed in them as an advisor. Senior partners were likely of being impersonated through fake social profiles and spoofed domains. Fraudulent job postings and phishing campaigns leaned on the firm's own credibility to look legitimate. The attacker doesn't need to breach the firm's network if a client can be convinced, through a look-alike domain or a cloned executive profile, to simply hand over what the attacker wants.

That's the mechanism UNC3753 exploited nationally in 2026, and it's the exact exposure this consulting firm was trying to close.

Also read: Ransomware Threats in the Americas H1 2026: Dissecting the Regional Attack Patterns and Dominant Actors

What is the "whack-a-mole" problem in brand protection?

Here's where most brand protection programs quietly fail, and it isn't a detection problem — it's a speed problem.

A typical manual takedown workflow looks something like this: someone on the security or marketing team spots a phishing page or a fake LinkedIn profile impersonating a partner. They file an abuse report with the registrar or the platform. They wait. Maybe they follow up. Eventually, the page comes down — but by then, a new one has often already gone live, sometimes registered by the same actor under a slightly different domain.

This was exactly the challenge the consulting firm faced before its engagement with Cyble. Identifying and removing phishing pages, fraudulent job postings, and impersonating domains was, in the case study's own words, reactive and resource-intensive, leaving the brand exposed for longer than the firm considered acceptable. It's a program that looks active — tickets filed, pages eventually removed — while the actual window of exposure, the hours where a client or job candidate could act on the fake page, stays wide open. Volume of takedowns filed is an easy number to report. Speed of resolution is the number that actually protects anyone.

What does managed takedown response actually involve

The shift the case study describes isn't just "faster takedowns" — it's a change in the operating model, from reactive point-solution to continuous, managed coverage. Three pieces work together in the deployment:

• Brand and Executive Monitoring continuously scans for phishing domains, fraudulent job postings, and impersonation attempts using the firm's name, alongside dedicated monitoring of senior leadership profiles across social platforms — catching the fake partner LinkedIn account or spoofed domain before it's had time to circulate.
• Verification before escalation means the security team isn't drowning in unconfirmed alerts. Threats are validated as genuine before they ever reach someone's desk, which is what separates consolidated intelligence from just another noisy dashboard.
• Managed Takedown Services then handle the actual removal — confirmed phishing pages, impersonating domains, and fraudulent listings — without the internal team having to individually chase registrars and platforms one abuse ticket at a time.

The outcome is a meaningfully shortened window between detection and removal — turning a slow, manual, ticket-by-ticket grind into something closer to continuous coverage. That's the real distinction between a takedown service and a takedown program: one reacts when someone happens to notice a fake page; the other is built to notice, verify, and resolve on a timeline that assumes attackers move fast, because they do.

Why client trust is the real asset at risk

For a consulting firm, the financial cost of an impersonation attack is rarely the headline risk. The deeper cost is what it does to the relationship a firm's entire business is built on. When a client, a job candidate, or a prospective hire can't tell the difference between a legitimate email from the firm and a spoofed one, the firm's advisory credibility — the thing it's actually selling — starts to erode. That's a slower, quieter kind of damage than a wire fraud loss, but for a professional services firm, it may be the more expensive one.

The lesson from both the national threat data and this specific engagement is the same – brand and executive impersonation isn't a marketing nuisance to be cleaned up occasionally. It's a live attack surface, moving at a speed that manual, ad hoc takedown processes were never built to match. Firms that treat it that way — with continuous monitoring, verified alerts, and managed resolution — are the ones that keep the exposure window measured in hours instead of days.

---

Frequently asked questions (FAQs)

What is a brand impersonation takedown service?

A brand impersonation takedown service identifies fraudulent domains, phishing pages, fake social media profiles, and impersonating job listings that misuse a company's name or logo, then works with registrars, hosting providers, and platforms to have that content removed.

How long does it take to take down a phishing site?

Timelines vary by registrar and hosting provider, but manual, ticket-based takedown requests commonly take days to resolve. Managed takedown programs that pre-verify threats and maintain direct relationships with providers can shorten that window to hours.

Why do manual takedown processes fail against brand impersonation?

Manual processes fail because they're reactive: a person has to notice the fake page, file a report, and wait for a third party to act, while attackers can register replacement domains faster than any single report gets resolved. The volume of tickets filed can look productive even while the actual exposure window stays open.

What's the difference between takedown volume and takedown speed?

Takedown volume measures how many fraudulent pages were reported or removed over time. Takedown speed measures how quickly a live threat is detected, verified, and taken down after it appears. Speed is the metric that actually limits damage, since most harm from a phishing page happens in its first hours online.

How can consulting and professional services firms protect executives from impersonation?

Dedicated executive monitoring tracks senior leaders' names and likenesses across social platforms and the web to catch fake profiles, spoofed communications, and impersonation attempts early, ideally paired with managed takedown so confirmed threats are removed without requiring the executive or internal team to handle it themselves.

---

Sources:

FBI Internet Crime Complaint Center, 2025 Internet Crime Report;
Cyble, "How Cyble Delivered Unified Multi-Layered Threat Intelligence to a U.S. Consulting Organization";
Google/Mandiant, "Ongoing Targeted Campaign Against US Law Firms" (2026);
American Bar Association Legal Technology Survey.

The post Brand Impersonation Takedown: From Whack-a-Mole to Managed Response appeared first on Cyble.

Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks have become primary platforms for hosting phishing pages and sites. Throughout 2025 and 2026, we have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This post analyzes the mechanics of a real-life adversary-in-the-middle (AitM) attack in a cloud environment and presents detailed statistics on the platforms and domains phishers abuse most frequently.

The cloud as a safe haven for phishers

Threat actors select platform-as-a-service (PaaS) offerings and distributed cloud environments to host phishing sites for much the same reasons legitimate software developers do:

• Inherent trust and reputation. Phishing pages hosted on reputable platforms appear trustworthy, reducing suspicion among potential victims.
• Most platforms offer generous free-tier developer plans. The onboarding process takes minutes and rarely requires Know Your Customer (KYC) identity verification. This enables a single operator to create hundreds of malicious accounts.
• Evasion and anonymity. Attackers leverage native security features to obscure their true origin server IP address behind a CDN, which complicates detection for security vendors.

Additionally, these platforms allocate shared subdomains hosting millions of legitimate projects and websites. Security teams cannot simply block the parent domain or its subdomains without inflicting collateral damage on bona fide users – a limitation that malicious actors take advantage of. To counter this tactic, security vendors must advance content-based analysis methodologies.

Multi-stage AitM attack

Consider a modern AitM phishing campaign that leverages Cloudflare Workers, a widely adopted cloud platform. The attackers execute the operation through multiple HTML pages distributed across a compromised website and the cloud platform. Each page serves a specific function: harvesting target email addresses, initializing the reverse-proxy infrastructure, or spoofing the login form to capture multi-factor authentication (MFA) sessions.

Stage 1. Contact harvesting and network monitoring evasion

The attack typically begins with a phishing email that uses a plausible pretext – such as a request from a coworker to review documents – to entice the target into clicking a malicious link.

Upon clicking the link, the user is redirected to a fake CAPTCHA landing page hosted on a compromised legitimate website. This specific campaign used the https://t[REDACTED]e.com website, but any other variations are possible. In this scenario, the compromised page served as a disposable relay — vendor detection mechanisms typically block phishing links delivered directly via email much faster — to prevent the early discovery of the core phishing content hosted on Cloudflare.

If the user entered their email address and clicked Continue, the pseudo-CAPTCHA marked them as a human user and initiated a redirect. The primary objective of this stage is to harvest target email addresses, filter out bots, and route legitimate users to a subdomain of workers.dev. Such subdomains are generated automatically and free of charge by Cloudflare Workers. The victim’s email address was embedded in the URL hash (the part of the URL following the # character), allowing the page at [REDACTED].workers.dev to extract the email without issuing a request to the attacker’s server, thereby avoiding detection.

Stage 2. Initializing a transparent proxy

The user’s browser then loaded a [REDACTED].workers.dev page with #user@business.com at the end of the URL. At this point, the page presented the victim with a genuine CAPTCHA challenge. This step ensured that an actual user was interacting with the page rather than a security sandbox.

Once the user successfully completed the challenge, a service worker was registered in their browser. This is a special JavaScript file capable of running in the background and intercepting all network requests generated by the current tab. As this type of script was designed as a core component of progressive web apps (PWAs) to optimize load times and support offline functionality, browsers treat service workers as standard site feature and execute them without prompting for user consent as long as the website uses an HTTPS connection.

The attackers leveraged the service worker to deploy Ultraviolet, a legitimate open-source web proxy library, to dynamically rewrite all links and forms on the page. This forced every outgoing request – including those for Microsoft login credentials – to route through the attackers’ server rather than directly to the legitimate services.

Immediately upon loading, the page extracted the victim’s email address from the URL hash and stored it in the browser’s sessionStorage property so it would not be overwritten when the CAPTCHA loaded. This step also allowed the script to pre-fill the username field in the form automatically. A pre-populated login field enhanced the page’s credibility and bolstered user trust. Once the CAPTCHA was passed, the malicious script constructed a redirect URL for the third stage, appending the email retrieved from sessionStorage back to the hash. By passing the email via the URL hash across three consecutive stages, the attackers successfully kept it hidden from network attack detection systems.

Stage 3. Session hijacking and browser window spoofing

The final stage unfolded on a third page, combining adversary-in-the-middle (AitM) traffic interception with a browser-in-the-browser (BitB) UI spoofing technique. BitB attacks operate by rendering a block inside a legitimate webpage that visually mimics a native browser pop-up window.

In this case, the script hosted on the attacker’s page generated a pop-up visually identical to a native browser window, complete with window controls and a spoofed address bar showing a trusted Microsoft URL. Within this simulated window, an iframe loaded the authentic login interface, routed dynamically through the service worker reverse proxy created in Stage 2. When the victim entered their credentials and MFA code into the BitB window, the proxy script intercepted both the credentials and the session tokens. Combining BitB with AitM significantly increases the threat: BitB provides a convincing, trusted visual wrapper (displaying a legitimate URL and branding), while the hidden AitM proxy quietly handles traffic interception and session hijacking behind the scenes.

Upon successful login, the proxy instructs the interface to close the pop-up and redirect the victim to a generic system error page, such as SessionExpired. This minimizes suspicion: the victim assumes a technical glitch occurred and attempts to log in again, unaware that the attacker already has full access to the session.

Cloud platform phishing attack statistics

We analyzed phishing URLs hosted across popular cloud platforms – including Cloudflare, Netlify, and GitHub Pages – over a 12-month period spanning August 2025 to July 2026. The data below outlines trends in unique third-level domains exploited to deliver phishing content. In total, our security solutions blocked 224,984 unique third-level domains on cloud and decentralized services used in phishing attacks within that timeframe.

Number of unique third-level domains
(download)

Based on this telemetry, we compiled a list of the TOP 10 cloud domains most frequently abused in phishing campaigns over the specified period.

Unsurprisingly, Cloudflare and Vercel emerged as the undisputed leaders: both offer free tiers, automated SSL certificate issuance, and global CDNs. GitHub Pages ranked third. The widespread legitimate use of the github.io domain complicates bulk blocking efforts, as security teams risk limiting access to non-malicious projects.

Decentralized networks also warrant close attention – we posted on this subject in 2023. The ipfs.io and dweb.link domains function as IPFS gateways. The principal risk associated with these platforms is content persistence: even if a specific gateway gets blocked, the phishing page remains accessible via alternative nodes across the network.

The visual website builders Wix and Webflow also ranked among the TOP 10 (eighth and ninth, respectively). These platforms allow low-skilled individuals to build phishing pages rapidly without advanced coding expertise, which significantly lowers the barrier to entry for less capable malicious actors.

 

	Domain	Number of phishing links	Platform
1	pages.dev	24.9%	Cloudflare Pages
2	vercel.app	13.8%	Vercel
3	github.io	13.7%	GitHub Pages
4	netlify.app	10.0%	Netlify
5	dweb.link	7.8%	IPFS gateway
6	ipfs.io	5.3%	IPFS (InterPlanetary File System)
7	workers.dev	2.5%	Cloudflare Workers
8	wixstudio.com	1.9%	Wix Studio
9	webflow.io	1.0%	Webflow
10	azurewebsites.net	1.0%	Microsoft Azure
	Other	17.9%

In total, we identified and neutralized over 390,000 phishing pages hosted across legitimate cloud platforms and decentralized networks (IPFS) over the past 12 months. This data confirms that threat actors actively exploit the implicit trust associated with legitimate PaaS providers (such as Cloudflare Workers, Vercel, Netlify, and GitHub Pages) and IPFS gateways. High domain reputation, generous free tiers, and built-in evasion capabilities enable phishers to deploy multi-stage AitM attacks designed to hijack MFA sessions.

Recommendations

Traditional security controls, such as relying on HTTPS lock icons or reputation-based domain denylists, are inadequate against these attacks. The cloud provider’s apex domain maintains a positive reputation score, while attackers generate malicious subdomains programmatically and at scale.

Effective defense against these threats calls for a layered security posture:

• Exercise caution with unexpected requests, even if they are served from reputable domains or secured with valid SSL/TLS certificates.
• Treat any CAPTCHA interface requiring personal data input as a possible scam. Legitimate CAPTCHA challenges rarely request personally identifiable information, such as email addresses.
• Inspect the URL in the address bar at the very top of the browser window. In BitB attacks, threat actors can render a fake browser pop-up displaying any target URL, even a legitimate one. However, the true address bar – located at the top of the main browser window alongside native navigation controls (Back, Forward, Refresh) – will continue to display the actual attacker-controlled domain.
• Avoid entering credentials in pop-ups you did not expect to see. If a login or MFA form appears without your explicit action, close the tab immediately. Navigate to the intended service manually by entering its address directly into the browser.
• Additional protection can be provided by Kaspersky Secure Mail Gateway for enterprise environments and Kaspersky Premium for personal correspondence. These robust email security solutions neutralize phishing links at the delivery stage before they reach the inbox.

Kaspersky Security Services provide a comprehensive cybersecurity ecosystem, taking enterprise threat protection to another level. Services like Kaspersky Managed Detection and Response and Compromise Assessment allow for timely detection of threats and cyberattacks. SOC Consulting provides a practical approach ensuring the corporate infrastructure stays secured, while Incident Response is suited for timely remediation with a maximized recovery rate.

This new report brings together statistics across regions and industries from our Managed Detection and Response and Incident Response services, and for the first time, it also includes insights from our Compromise Assessment and SOC Consulting services — all to provide you with more comprehensive view of different aspects of corporate information security worldwide.

The scope of MDR and IR services

Provision of Kaspersky’s MDR and IR services follows a global approach. The majority of customers accounted for the CIS (34.7%), the Middle East (20.1%), and Europe (18.6%).

MDR telemetry

Following the previous year’s numbers, in 2025, the MDR infrastructure received and processed an average of 15,000 telemetry events per host every day, generating security alerts as a result. These alerts are first processed by AI-powered detection logic, after which Kaspersky SOC analysts handle them as required. Overall, a total of approximately 400,000 alerts were generated in 2025. After counting out false positives, 39,000 alerts were further investigated.

Incident statistics

The distribution of remediation requests by industry has slightly changed as compared to previous years’ pattern. Government (18.5%) and industrial (16.6%) organizations are still the most targeted industries in regards to cyberattacks that require incident response activities. However, this year, the IT sector saw a growth in the number of IR requests, eventually being placed third in the overall industry distribution rankings and thus replacing financial organizations, which were targeted less often than in 2024. This is equally true for smaller-scale attacks that can be contained and remediated through automated means — the only difference is that medium- and low-severity incidents are more often experienced by financial organizations.

Key trends and statistics

This section presents key findings and trends in cyberattacks in 2025:

• The number of high-severity incidents decreased, following a downward trend that we’ve been observing since 2021. The majority of those incidents account for APT attacks and red teaming exercises, which indicates two landscape trends. On the one hand, skilled adversaries make efforts to increase impact, while on the other, organizations spend more resources on probing their defense systems.
• The most common vulnerabilities exploited in the wild were related to Microsoft products. Half of all identified CVEs led to remote code execution, notably without authentication in some cases.
• Exploitation of public-facing applications, valid accounts, and trusted relationships remain the most popular initial vectors, and their overall share has increased, accounting to over 80% of all attacks in 2025. In particular, attacks through trusted relationships are evolving: their share has increased to 15.5% from 12.8% in 2024. They are also becoming more complex: for instance, we witnessed a case where adversaries had compromised more than two organizations in sequence to ultimately gain access to a third target.
• Standard Windows utilities remain a popular LotL tool. Adversaries use those to minimize the risk of detection during delivery to a compromised system. The most popular LOLBins we observed in high-severity incidents were powershell.exe (14.4%), rundll32.exe (5.9%), and mshta.exe (3.8%). Among the most popular legitimate tools used in incidents we flag Mimikatz (14.3%), PowerShell (8.1%), PsExec (7.5%), and AnyDesk (7.5%).

The full 2026 Global Report provides additional information about cyberattacks, including real-world cases discovered by Kaspersky experts. We also describe SOC Consulting projects and Compromise Assessment requests. The report includes comprehensive analysis of initial attack vectors in correlation with the MITRE ATT&CK tactics and techniques and the full list of vulnerabilities that we detected during Incident Response engagements.