Cybercriminals Exploit Bubble.io No-Code Platform for Phishing Attacks Security researchers at Kaspersky have uncovered a new phishing tactic where cybercriminals abuse Bubble.io, a legitimate no-code app development platform, to bypass email security filters and steal Microsoft 365 credentials. Attackers leverage Bubble.io’s drag-and-drop editor or its AI chatbot to create malicious web apps with embedded phishing functionality, hosted on the platform’s trusted domain. Since the apps reside on bubble.io, email security tools fail to flag them, allowing phishing emails to reach victims’ inboxes undetected. The phishing apps often mimic Microsoft login portals, sometimes hidden behind a Cloudflare verification check. Unsuspecting users who enter their credentials unknowingly hand them over to attackers, who can then exploit access for data theft, ransomware deployment, or further attacks on organizations. Kaspersky warns that this technique is likely to gain traction, particularly among Phishing-as-a-Service (PhaaS) providers, which already offer advanced features like 2FA code interception, geo-fencing to evade analysis, and AI-generated phishing emails. The abuse of legitimate platforms like Bubble.io makes these attacks harder to detect and more scalable for less-skilled threat actors. While this method is new, cybercriminals have long exploited trusted services such as PayPal, Google Tasks, and Microsoft Azure Monitor alerts to enhance phishing campaigns. Bubble.io has not yet responded to reports of the abuse, and no official statement has been issued. The discovery highlights an ongoing trend of threat actors weaponizing legitimate tools to evade security measures.

Cybercriminals Exploit Bubble’s No-Code Platform to Bypass Phishing Detection Threat actors are leveraging Bubble, a no-code app-building platform, to host malicious web apps that evade phishing detection in campaigns targeting Microsoft accounts. By abusing the platform’s legitimate infrastructure, attackers create apps that redirect users to fake Microsoft login portals often hidden behind Cloudflare checks to steal credentials for Microsoft 365 access. Security researchers at Kaspersky identified the tactic, noting that apps hosted on Bubble’s trusted bubble.io domain bypass email security filters. The malicious apps use complex JavaScript bundles and Shadow DOM structures, making them difficult for automated analysis tools to flag as threats. Even manual inspection is challenging, as the generated code appears as a "massive jumble" of legitimate-looking scripts. Once victims enter credentials on the fake login pages, attackers harvest them to access emails, calendars, and other sensitive data. The method’s stealth and scalability raise concerns that phishing-as-a-service (PhaaS) platforms may adopt it, integrating it into kits that already include 2FA bypasses, session cookie theft, and AI-generated phishing emails. Bubble has not yet responded to inquiries about potential anti-abuse measures. The abuse of no-code platforms marks a growing trend in evasion techniques, complicating detection for both automated systems and security teams.