By: Micah DeHarty, Intelligence Team
Threat actors are using the Artificial Intelligence (AI) web development tool, Vercel, to quickly create large numbers of realistic phishing websites that spoof well-known brands. With just a few text prompts, attackers can generate phishing pages that closely resemble legitimate sites in both appearance and functionality. This shift in tactic shows the full adoption of Generative Artificial Intelligence (GenAI) by threat actors. Although Vercel requires an account to use its Gen AI features, signing up is easy, and there is a free tier available that allows threat actors to make use of basic features.
There are three account tier options, including a free tier, a pro tier, and an enterprise tier. The free tier limits users to the bare minimum offerings, while the pro tier offers most features for a minimum cost of twenty dollars per month. While it was not previously uncommon for phishing pages to resemble legitimate pages, Vercel makes this process easier with the use of GenAI and quick-deploy functionality. Vercel’s ease of use allows for less skilled threat actors to create more realistic phishing pages than previously possible. Vercel also has the capability to use integrations with other legitimate tools abused by threat actors, such as Telegram.
At Cofense, our analysts on the Intelligence team have seen Vercel used in many different phishing campaigns varying in technique, complexity, and skill level. As GenAI continues to improve and become faster and easier to use, the capabilities of threat actors will continue to grow along with it. Minimally skilled threat actors now have access to advanced capabilities that were previously only accessible to advanced threat actors such as nation states.
Key Points
- Vercel is a cloud-based platform that allows users to quickly customize and deploy web pages with extensive detail.
- Vercel allows attackers to easily create web pages that resemble legitimate pages both visually and functionally.
- Integrations with Vercel allow threat actors to use other commonly abused legitimate tools in their phishing campaigns.
- Threat actors are able to redeploy phishing campaigns with ease if a web page is taken down.
- Vercel abuse has increased significantly over time and is likely to continue increasing as minimally skilled threat actors start using cheap or free force multipliers.
What is Vercel?
Vercel is a cloud-based platform that has integrated multiple AI models to build and deploy web applications and sites. The platform simplifies web development by automating deployment, hosting static websites, and integrating with many different frontend web development frameworks. In its intended form, Vercel is used to help developers quickly and easily create marketing sites, web applications, AI applications, and other web-based tools or platforms. Vercel is marketed towards web developers to build, scale, and secure personalized websites. Threat actors are using Vercel in a comparable manner, but with malicious intentions.
Most of the work using Vercel is centered around Generative AI. Vercel has created a GenAI-powered tool called “v0[.]dev” that can create working web pages using text prompts entered by the user. This AI tool is the driving force behind the malicious sign-in pages created by attackers. With just a few text prompts v0[.]dev can create a fully functioning malicious site that completely resembles real-life brands. Although Vercel has created a genuinely useful and innovative platform, threat actors are taking advantage of the platform and are abusing it for malicious gain.
Using Vercel to create phishing web pages is actually quite simple. Vercel allows users to test their GenAI models without an account or any cost associated. This test feature shows the different GenAI models that can be used, the cost to use the different models, and what each model provides. In the test, you can see how text prompts are handled and get a preview of the output from the text prompts used. The test feature is very limited and just gives a brief glimpse of what can be done with Vercel’s GenAI products. In order to get full use of Vercel, a user must first create an account. With the different account tiers, a user is given a certain number of “tokens” which are used as currency. Each token allows for a certain number of inputs and outputs for the GenAI products. For example, one token would allow a user to input five different prompts into the GenAI tool. Tokens can also be purchased by a user if they run out or need more for their work. Once a prompt is entered by the user, Vercel’s GenAI tool outputs what is being created along with a preview of the website. At this point, the user can make any changes they feel necessary.
Figures 1, 2, and 3 below show the process of creating a simple Microsoft sign-in page using Vercel’s GenAI product. The demo was done without an account and without paying for the product. Once the website is created using the test process, Vercel forces the user to create an account or sign in to continue. In Figure 1, the user is seen entering a text prompt to create a realistic Microsoft sign-in page using Vercel’s v0 Max GenAI. In Figure 2, the process of building the webpage is shown along with the additional text prompt location for making changes to the webpage. In Figure 3, a final preview of the spoofed Microsoft webpage is shown. This demonstration shows how easy it is to abuse Vercel and create realistic spoofed web pages.
Figure 1: Initial Text Prompt to Create the Webpage
Figure 2:Vercel GenAI in Progress
Figure 3:Webpage Created to Spoof Microsoft
Why Threat Actors are Using Vercel
One issue threat actors face when creating a phishing site is where and how to host the site. With Vercel’s hosting capabilities, attackers no longer have to maintain their own phishing website or recreate their whole server structure if the site gets taken down or removed. Even if the website created using Vercel’s v0[.]dev is taken down, there is nothing stopping the attacker from creating a brand-new website using what they have learned from their previous mistakes. Due to GenAI creating different outputs each time a prompt is given, threat actors do not have to produce new prompts each time they use the tool. The GenAI model adapts with the user’s input, creating better web pages with each attempt. With everything in Vercel being hosted in the cloud, creating and tearing down content is much easier. Vercel’s GenAI combines all of the components of a phishing kit purchased on the dark web into a simple interface requiring just a few natural language text prompts which can be done by just one minimally skilled threat actor.
Another reason for threat actors to use Vercel is that it allows for integration with other services, specifically Telegram. Telegram is a messaging platform that lets attackers create chat bots to notify them when credentials are entered into a webpage that the bot is monitoring. Vercel’s Telegram integration helps attackers combine both the ease of GenAI web development and automated chatbots to make stealing credentials much easier. Telegram has already been widely abused by threat actors, but now those threat actors do not have to maintain every other aspect of the phishing web page, making Telegram use much more practical. The Telegram integration uses Telegram’s Bot API and Vercel’s cloud-hosted API routes to host the bot’s backend. The Telegram Bot API is a free, HTTP-based interface that allows users to create automated software that can interact with the Telegram messaging platform. Threat actors abuse this API using Vercel’s ability to route the API through cloud-based technology. The integration allows for real-time communication to Telegram bots triggered by events on the Vercel web page. Additional notable applications that can be integrated with Vercel are Amazon Web Services (AWS), the payment platform Stripe, and xAI. These integrations may not all be used for malicious activity, but they highlight the various legitimate tools that threat actors can abuse with their Vercel-hosted phishing sites.
Although Vercel has emerged as one of the main GenAI platforms used for phishing, there are a few others worth mentioning. One other main GenAI platform being used is DeepSite AI. DeepSite is a free platform that allows a user to build websites using different AI code bases like Gemini and GPT. BlackBox also implements a free version but provides more customization with their paid offerings. While these tools provide many of the same features as Vercel, they do not provide the branding, hosting, and integration that Vercel has. There are also tools specifically built for malicious purposes, such as FraudGPT and WormGPT. These tools are designed for threat actors but do not provide the accessibility and detail provided by Vercel.
Figure 4:Line Chart Showing Vercel Usage Seen by Cofense Intelligence from 2022 to 2026
Real-Life Examples
At Cofense Intelligence, our analysts have seen an array of phishing campaigns that utilize Vercel. These emails include job interview spoofing campaigns, fake Microsoft landing pages, Spotify spoofing emails, and many more. The image database that can be accessed by Vercel users contains a variety of popular brand icons, making the possibilities virtually endless for what attackers can spoof. At Cofense Intelligence we maintain a database of Active Threat Reports (ATR) within our ThreatHQ platform. These ATRs detail different threats seen by our Intelligence Analysts, such as Credential Phish, types of malware, and the context of the campaign. In ATR 406705, we documented a threat actor creating a page resembling a Nike job posting. The phish mimics a recruiter reaching out to schedule an interview. The threat actor is able to both accurately replicate the look and the functionality of a real job posting. We see this tactic used for many different recognizable brands that may be enticing to click on. This job interview spoof has been seen replicating brands such as Adidas, Ferrari, Louis Vuitton, and many more. The job spoof typically mimics a calendar invite followed by a fake Facebook or Google login page. Both the calendar invite page and login page are created using Vercel’s GenAI product.
In ATR 403225 Cofense Intelligence analysts observed the previously mentioned fake job posting campaign, but this time with the Telegram Bot integration. The threat actor is posing as an Adidas hiring manager, reaching out for an open executive position. The link embedded in the email takes the user to what looks like the Adidas Careers page and then to a fake Facebook login page. In Figure 5 below, you can see the fake Adidas Careers page used to trick a user into entering their credentials.
Figure 5: Fake Adidas Careers page created using Vercel from ATR 403225.
Another example of a common phishing campaign using Vercel was seen in ATR 402228, spoofing the commonly used Microsoft landing page. While the Microsoft sign-in page is commonly spoofed by threat actors in other phishing campaigns, the use of Vercel to replicate the landing page allows the threat actor to use bot integrations and custom web page attributes that detect and prevent common analysis tools and techniques. Since there are so many applications that use Microsoft to sign in, attackers are able to use a wide array of lures to lead a user to the Microsoft landing page.
In Figure 6, we see threat actors leveraging Vercel to create a very realistic Spotify spoofing landing page. It takes the exact same logos, wording, color scheme, and functionality of the real Spotify sign-in page. However, when a user enters credentials, the page sends the credentials to the attacker and redirects the user to another page asking for credit card information. None of this is new to phishing, but the way that the web page is created and the back-end functionality is handled represents a new normal.
Figure 6: Example of a web page created using Vercel from ATR 385870.
Conclusion
Overall, Vercel has created a pathway for minimally skilled threat actors to mass-produce convincing phishing web pages. With Vercel’s GenAI, easy hosting, and quick-deploy capabilities, and various third-party integrations, attackers have a simplified method to create malicious landing pages with a few simple steps. The days are gone in which advanced phishing websites needed to be produced by skilled developers. Less skill and less effort while producing massive quantities at higher quality is bringing Vercel to the forefront of abused GenAI-produced phishing websites. With Generative AI becoming increasingly advanced, the opportunities for threat actors to use it for malicious purposes are growing with it.
Remediation
What can you do to protect yourself or your company from this threat?
- End-user training on what to look for and what to do if you get a phishing email is key.
- The phishing pages are very visually convincing so it is important to reiterate that users may need to look for other signs that the email or webpage are malicious.
- It is no longer as simple as saying “look for obvious mistakes” in the email or web page because the GenAI typically does not make simple mistakes.
- To help prevent future abuse, you can report malicious sites created in Vercel directly to Vercel for takedowns.
- At Cofense Intelligence, our team is diligently looking for any malicious activity related to Vercel, and publishing those via Active Threat Reports in our ThreatHQ platform.
