Vercel Hosting Abused to Push Remote Access Tool

A recent phishing campaign, active from November 2025 to January 2026, has seen Vercel hosting abused to distribute a remote access tool under the guise of legitimate online services. Threat actors behind the operation crafted emails with financial lures like overdue invoices and shipping documents, prompting users to click embedded links. These links led to Vercel-hosted pages rigged with sophisticated browser fingerprinting and detection-evasion capabilities.

Victims were funneled through filters powered by Telegram that screened IP addresses, browser data and geographic indicators before granting access to a malicious file. This file, often disguised as a financial document, delivered a signed copy of GoTo Resolve—previously LogMeIn—as its payload. Cloudflare identified the campaign’s evolution from earlier tactics, highlighting its tailored targeting strategies, including region-specific emails and spoofed services.

The campaign underscores how Vercel hosting was abused to sidestep traditional security measures and deploy remote-access software undetected.

Read the full article at https://cybersecuritynews.com/new-phishing-attack-leverages-vercel-hosting-platform/