Microsoft’s Azure cloud business brought in $33.2 billion in revenue in the September quarter, up 48% from a year earlier, blowing past the company’s own forecast and beating Wall Street’s expectations.

The growth suggests that Microsoft is selling cloud and AI computing about as fast as it can install it. Azure revenue rose $10.8 billion from a year earlier, driven by demand for services across the platform, Microsoft said in its quarterly filing. That came even as some new data center capacity arrived late.

For investors worried about Microsoft’s record capital spending, it’s a sign that the company’s massive AI and cloud infrastructure buildout is turning into sales. Microsoft’s shares rose nearly 4% in after-hours trading following the earnings report.

Overall, Microsoft reported revenue of $92.3 billion for the first quarter of its 2027 fiscal year, up 19% and above the $90.75 billion analysts expected, according to Yahoo Finance. Earnings were $4.89 per share excluding the impact of its OpenAI investment, compared with expectations of $4.72.

It’s the first time Microsoft has reported Azure’s quarterly revenue figure, not just its growth. The disclosure is part of a new financial structure that took effect this quarter, splitting the company into two segments: Agents and Infra, and Devices and Consumer.

• Agents and Infra (Azure, Microsoft 365, Dynamics, LinkedIn’s recruiting and sales tools, and server and productivity licensing): Revenue rose 25% to $76.8 billion, above Microsoft’s forecast of $75.15 billion to $75.75 billion. Operating income rose 24% to $40.6 billion.
• Devices and Consumer (Windows, Xbox, and search and advertising): Revenue fell 3% to $15.5 billion, above Microsoft’s forecast of $14.7 billion to $15.2 billion. Operating income rose 2% to $5.4 billion.

Capital spending came in below Microsoft’s forecast. The company spent $45.2 billion, including finance leases, short of the more than $50 billion it expected. Some data center capacity that third parties were supposed to deliver in the quarter was delayed, the company said.

Google Cloud, which includes Google’s Workspace productivity apps, brought in $30.7 billion in revenue in the quarter, up 103% from a year earlier, Alphabet reported Wednesday afternoon.

Amazon reports earnings Thursday afternoon, including AWS results.

Update, 3:05 p.m.:Microsoft expects Azure growth to accelerate again this quarter, to 49% to 50% excluding currency changes, CFO Amy Hood said on the earnings call. “Customer demand continues to exceed available supply,” she said.

Hood said Azure’s growth came from Foundry, Microsoft’s service for building AI apps and agents, and from engineering work that let Microsoft sell unused capacity on its existing servers. That helped make up for delays in new data center capacity that outside providers were supposed to deliver.

Those delays pushed some spending later into the fiscal year. Microsoft now expects to spend about $170 billion on capital expenditures in calendar 2026, down from about $175 billion. It expects to spend more than $50 billion this quarter, and Hood said spending will accelerate in the first half of calendar 2027.

Hood also said Microsoft may tap additional sources of financing to help pay for the buildout, “when we believe it is attractive to do so.” The company still expects to bring in more cash than it spends this fiscal year.

Microsoft’s expense forecast for the December quarter includes an estimate for the buyout offer it announced Monday, Hood said, though she didn’t give the amount.

The company expects total revenue of $96 billion to $97.1 billion for the December quarter, above the $95.7 billion analysts expected, according to Yahoo Finance.

Google Cloud’s London outage disrupted banking apps and business services. Learn what happened and what IT teams should check after service recovery.

The post Google Cloud London Outage Disrupts Banking and Business Services appeared first on TechRepublic.

Google Cloud’s London outage disrupted banking apps and business services. Learn what happened and what IT teams should check after service recovery.

The post Google Cloud London Outage Disrupts Banking and Business Services appeared first on TechRepublic.

AI infrastructure startup Nscale is doubling down on its new Seattle-area presence before even opening the doors.

After initially leasing a single floor at The Eight tower in downtown Bellevue earlier this year, the London-based company has expanded by an additional floor, bringing its total footprint in the new development to approximately 46,000 rentable square feet, according to a report from The Broderick Group.

The expansion signals an aggressive ramp-up for Nscale’s primary U.S. engineering hub, slated to open in January 2027. While the initial 24,000-square-foot lease was pegged to accommodate up to 250 employees, the added space gives the fast-growing cloud provider room to scale its local team even further beyond its current 50 Seattle-area workers.

Founded in 2024, Nscale is riding a massive wave of capital and growth.

It raised a $2 billion Series C round at a $14.6 billion valuation earlier this year, backed by Nvidia, Dell, Citadel, Jane Street, and Point72, alongside a $900 million credit line.

The company also earlier this year hired Nidhi Chappell, the former Microsoft corporate vice president who led Azure AI and high-performance computing infrastructure, including the supercomputers that power ChatGPT. As Nscale’s new president of AI infrastructure, based in the Seattle area, Chappell will oversee the company’s global engineering and data center operations.

“I’ve had a front-row seat to some of the biggest moments in AI over the past several years, but one thing has always stood out: the world remembers the breakthroughs, but it’s the people building the infrastructure behind the scenes who make them possible,” Chappell wrote in a LinkedIn post earlier this year announcing the company’s first “onboarding” event in Seattle.

Nscale’s new office is set to open in January, with the second floor slated to open in June, reports The Puget Sound Business Journal.

The company’s growth underscores Bellevue’s growing magnetism for out-of-town AI players. The company joins a dense ecosystem of AI infrastructure and application hubs establishing outposts on the Eastside, including xAI, OpenAI, Databricks, CoreWeave, Armada, and Anduril.

Goldman Sachs is expanding its technology presence in the Seattle region, opening a new Bellevue engineering center that will accommodate more than 125 employees focused on artificial intelligence and cloud transformation.

The New York-based financial giant held a ribbon-cutting ceremony this month for the new office, its first dedicated space for engineers in the Pacific Northwest.

The Bellevue location adds to Goldman Sachs’ existing presence in downtown Seattle, where the company has maintained an office since 2001 for its banking and wealth management divisions.

“We are in a period of rapid technological change, but we know our people are still this firm’s greatest asset,” Goldman Sachs Chairman and CEO David Solomon said in a statement. “Hiring exceptional talent is central to how we adapt and grow.”

The move also puts Goldman Sachs in the company of a growing list of financial and technology companies that have established engineering operations in the Seattle area. GeekWire maintains a list of nearly 150 engineering hubs in the Seattle region here.

JPMorgan Chase established its Seattle Tech Center in 2018 and has steadily expanded it. The engineering hub has grown to about 400 employees and is now anchoring a new AI infrastructure team focused on controlling how the bank runs AI across its own data centers and outside cloud providers.

Goldman Sachs said its new Bellevue location comes amid growth at other facilities in Dallas, Salt Lake City and Warsaw. Earlier this month, the company hired Dinesh Keswani — a former Microsoft and GoDaddy engineering leader — to co-lead its core engineering team alongside Gopi Parameswaran. Keswani will also serve as chief technology officer of The Core Engineering. 

Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks have become primary platforms for hosting phishing pages and sites. Throughout 2025 and 2026, we have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This post analyzes the mechanics of a real-life adversary-in-the-middle (AitM) attack in a cloud environment and presents detailed statistics on the platforms and domains phishers abuse most frequently.

The cloud as a safe haven for phishers

Threat actors select platform-as-a-service (PaaS) offerings and distributed cloud environments to host phishing sites for much the same reasons legitimate software developers do:

• Inherent trust and reputation. Phishing pages hosted on reputable platforms appear trustworthy, reducing suspicion among potential victims.
• Most platforms offer generous free-tier developer plans. The onboarding process takes minutes and rarely requires Know Your Customer (KYC) identity verification. This enables a single operator to create hundreds of malicious accounts.
• Evasion and anonymity. Attackers leverage native security features to obscure their true origin server IP address behind a CDN, which complicates detection for security vendors.

Additionally, these platforms allocate shared subdomains hosting millions of legitimate projects and websites. Security teams cannot simply block the parent domain or its subdomains without inflicting collateral damage on bona fide users – a limitation that malicious actors take advantage of. To counter this tactic, security vendors must advance content-based analysis methodologies.

Multi-stage AitM attack

Consider a modern AitM phishing campaign that leverages Cloudflare Workers, a widely adopted cloud platform. The attackers execute the operation through multiple HTML pages distributed across a compromised website and the cloud platform. Each page serves a specific function: harvesting target email addresses, initializing the reverse-proxy infrastructure, or spoofing the login form to capture multi-factor authentication (MFA) sessions.

Stage 1. Contact harvesting and network monitoring evasion

The attack typically begins with a phishing email that uses a plausible pretext – such as a request from a coworker to review documents – to entice the target into clicking a malicious link.

Upon clicking the link, the user is redirected to a fake CAPTCHA landing page hosted on a compromised legitimate website. This specific campaign used the https://t[REDACTED]e.com website, but any other variations are possible. In this scenario, the compromised page served as a disposable relay — vendor detection mechanisms typically block phishing links delivered directly via email much faster — to prevent the early discovery of the core phishing content hosted on Cloudflare.

If the user entered their email address and clicked Continue, the pseudo-CAPTCHA marked them as a human user and initiated a redirect. The primary objective of this stage is to harvest target email addresses, filter out bots, and route legitimate users to a subdomain of workers.dev. Such subdomains are generated automatically and free of charge by Cloudflare Workers. The victim’s email address was embedded in the URL hash (the part of the URL following the # character), allowing the page at [REDACTED].workers.dev to extract the email without issuing a request to the attacker’s server, thereby avoiding detection.

Stage 2. Initializing a transparent proxy

The user’s browser then loaded a [REDACTED].workers.dev page with #user@business.com at the end of the URL. At this point, the page presented the victim with a genuine CAPTCHA challenge. This step ensured that an actual user was interacting with the page rather than a security sandbox.

Once the user successfully completed the challenge, a service worker was registered in their browser. This is a special JavaScript file capable of running in the background and intercepting all network requests generated by the current tab. As this type of script was designed as a core component of progressive web apps (PWAs) to optimize load times and support offline functionality, browsers treat service workers as standard site feature and execute them without prompting for user consent as long as the website uses an HTTPS connection.

The attackers leveraged the service worker to deploy Ultraviolet, a legitimate open-source web proxy library, to dynamically rewrite all links and forms on the page. This forced every outgoing request – including those for Microsoft login credentials – to route through the attackers’ server rather than directly to the legitimate services.

Immediately upon loading, the page extracted the victim’s email address from the URL hash and stored it in the browser’s sessionStorage property so it would not be overwritten when the CAPTCHA loaded. This step also allowed the script to pre-fill the username field in the form automatically. A pre-populated login field enhanced the page’s credibility and bolstered user trust. Once the CAPTCHA was passed, the malicious script constructed a redirect URL for the third stage, appending the email retrieved from sessionStorage back to the hash. By passing the email via the URL hash across three consecutive stages, the attackers successfully kept it hidden from network attack detection systems.

Stage 3. Session hijacking and browser window spoofing

The final stage unfolded on a third page, combining adversary-in-the-middle (AitM) traffic interception with a browser-in-the-browser (BitB) UI spoofing technique. BitB attacks operate by rendering a block inside a legitimate webpage that visually mimics a native browser pop-up window.

In this case, the script hosted on the attacker’s page generated a pop-up visually identical to a native browser window, complete with window controls and a spoofed address bar showing a trusted Microsoft URL. Within this simulated window, an iframe loaded the authentic login interface, routed dynamically through the service worker reverse proxy created in Stage 2. When the victim entered their credentials and MFA code into the BitB window, the proxy script intercepted both the credentials and the session tokens. Combining BitB with AitM significantly increases the threat: BitB provides a convincing, trusted visual wrapper (displaying a legitimate URL and branding), while the hidden AitM proxy quietly handles traffic interception and session hijacking behind the scenes.

Upon successful login, the proxy instructs the interface to close the pop-up and redirect the victim to a generic system error page, such as SessionExpired. This minimizes suspicion: the victim assumes a technical glitch occurred and attempts to log in again, unaware that the attacker already has full access to the session.

Cloud platform phishing attack statistics

We analyzed phishing URLs hosted across popular cloud platforms – including Cloudflare, Netlify, and GitHub Pages – over a 12-month period spanning August 2025 to July 2026. The data below outlines trends in unique third-level domains exploited to deliver phishing content. In total, our security solutions blocked 224,984 unique third-level domains on cloud and decentralized services used in phishing attacks within that timeframe.

Number of unique third-level domains
(download)

Based on this telemetry, we compiled a list of the TOP 10 cloud domains most frequently abused in phishing campaigns over the specified period.

Unsurprisingly, Cloudflare and Vercel emerged as the undisputed leaders: both offer free tiers, automated SSL certificate issuance, and global CDNs. GitHub Pages ranked third. The widespread legitimate use of the github.io domain complicates bulk blocking efforts, as security teams risk limiting access to non-malicious projects.

Decentralized networks also warrant close attention – we posted on this subject in 2023. The ipfs.io and dweb.link domains function as IPFS gateways. The principal risk associated with these platforms is content persistence: even if a specific gateway gets blocked, the phishing page remains accessible via alternative nodes across the network.

The visual website builders Wix and Webflow also ranked among the TOP 10 (eighth and ninth, respectively). These platforms allow low-skilled individuals to build phishing pages rapidly without advanced coding expertise, which significantly lowers the barrier to entry for less capable malicious actors.

 

	Domain	Number of phishing links	Platform
1	pages.dev	24.9%	Cloudflare Pages
2	vercel.app	13.8%	Vercel
3	github.io	13.7%	GitHub Pages
4	netlify.app	10.0%	Netlify
5	dweb.link	7.8%	IPFS gateway
6	ipfs.io	5.3%	IPFS (InterPlanetary File System)
7	workers.dev	2.5%	Cloudflare Workers
8	wixstudio.com	1.9%	Wix Studio
9	webflow.io	1.0%	Webflow
10	azurewebsites.net	1.0%	Microsoft Azure
	Other	17.9%

In total, we identified and neutralized over 390,000 phishing pages hosted across legitimate cloud platforms and decentralized networks (IPFS) over the past 12 months. This data confirms that threat actors actively exploit the implicit trust associated with legitimate PaaS providers (such as Cloudflare Workers, Vercel, Netlify, and GitHub Pages) and IPFS gateways. High domain reputation, generous free tiers, and built-in evasion capabilities enable phishers to deploy multi-stage AitM attacks designed to hijack MFA sessions.

Recommendations

Traditional security controls, such as relying on HTTPS lock icons or reputation-based domain denylists, are inadequate against these attacks. The cloud provider’s apex domain maintains a positive reputation score, while attackers generate malicious subdomains programmatically and at scale.

Effective defense against these threats calls for a layered security posture:

• Exercise caution with unexpected requests, even if they are served from reputable domains or secured with valid SSL/TLS certificates.
• Treat any CAPTCHA interface requiring personal data input as a possible scam. Legitimate CAPTCHA challenges rarely request personally identifiable information, such as email addresses.
• Inspect the URL in the address bar at the very top of the browser window. In BitB attacks, threat actors can render a fake browser pop-up displaying any target URL, even a legitimate one. However, the true address bar – located at the top of the main browser window alongside native navigation controls (Back, Forward, Refresh) – will continue to display the actual attacker-controlled domain.
• Avoid entering credentials in pop-ups you did not expect to see. If a login or MFA form appears without your explicit action, close the tab immediately. Navigate to the intended service manually by entering its address directly into the browser.
• Additional protection can be provided by Kaspersky Secure Mail Gateway for enterprise environments and Kaspersky Premium for personal correspondence. These robust email security solutions neutralize phishing links at the delivery stage before they reach the inbox.