Summary Bullets:

• Zoom CX is a credible option for enterprises looking to transform their customer engagement with omni-channel and AI capabilities.

• Working with a broader partner ecosystem is pivotal for Zoom to win in CX space since this involves workflows and different business applications.

Zoom is well-known for its conferencing solution, which is used extensively in modern workplace, but it has gone well-beyond conferencing in recent years. The core business of Zoom has been the enabler of conversations within the workplace. To go beyond communications, the company sees new opportunities by expanding its role to help enterprises automate workflows during and after conversations (i.e., meetings and phone conversations). This vastly enlarges the value Zoom can deliver to enterprise customers, especially with the application of AI. For example, AI can eliminate many manual tasks such as generating documents from meeting with summaries and next steps, or updating CRM records after a discussion within the sales team.

Taking this concept a step further, conversations can also include external parties including customers and partners. One area that is of great strategic importance for Zoom is around customer experience (CX) – a rapidly transforming space as a result of enterprises striving to enhance CX to gain an upper hand against competition. This expands Zoom scope to help enterprises streamline workflows related to customer engagement, which can happen across customer services, delivery, marketing, and sales functions. The launch of Zoom Contact Center in 2022 was a major step toward building out the Zoom CX portfolio. The company has developed the product ground up, giving it the ability to meet customer demand with speed without the baggage of legacy systems and features. This is especially useful in having AI natively embedded in the platform instead of building a separate stack. Moreover, there should not be separate communications systems for the internal workplace and for the contact center. A key value proposition for Zoom is its common platform to address both scenarios and deliver the same experience.

Zoom Contact Center is an omni-channel solution with a single routing engine. It enables businesses to engage with their customers over channels such as voice, video, SMS, and chat. In 2023, the company added Zoom Virtual Agent, initially as a chatbot, and now as an agentic AI platform. To close the gap with other contact center offerings, Zoom also added Zoom Workforce Engagement Management, which includes Zoom Workforce Management and Zoom Quality Management. Moreover, it has introduced Zoom AI Expert Assist, a ready-to-deploy AI agent to provide end-to-end interaction guidance to contact center agents. Moreover, Zoom CX Insights provides a conversational intelligence layer to synthesize data across the CX portfolio to provide more accurate insights for faster decision-making. With the aim to simplify workflows, the ability to integrate with third-party applications is crucial. The company is enabling this through Zoom Marketplace, which already supports integration with a wide range of business applications (e.g., Google Workspace, Jira, Microsoft Dynamics, Salesforce, and many more).

While Zoom is a relatively new competitor in the contact center market, it has seen strong traction and winning significant deals. Oracle is the largest customer so far as the company moves its 15,000 global services agents to Zoom and integrates the tools with Oracle’s existing workflows. Zoom also leverages Oracle Cloud Infrastructure (OCI) to run Zoom CX, which can appeal to enterprises using OCI extensively. There are other customers that Zoom can reference too. National Storage, a self-storage company based in Australia with over 250 centers across Australia and New Zealand, has adopted Zoom Contact Center to connect with customers as well as its centers together. The company is now engaging customers through multiple channels (e.g., chat, email, and video); using Zoom AI to gain insights into customer interactions; and using Zoom for internal meetings and webinars. This highlights the power of having a single platform for both employee and customer engagements. With the system in place, National Storage is also able to further strengthen its CX leveraging AI, for example, using Zoom AI Expert Assist to provide cues to operators during customer interactions so that they can offer the best solutions.

The local government of Nara City (Japan), has also adopted Zoom Phone, Zoom Contact Center, and Zoom Virtual Agent, to replace its legacy PBX and contact center solution. This is part of its efforts to improve citizen services (a population of about 350,000) through its ‘’Nara Digital City Hall’’ initiative and to drive digital transformation within municipal operations. This customer highlights the importance of integration between the cloud-based PBX and the contact center to deliver a seamless experience for employees. AI is a requirement as well. Nara City is looking to use AI features such as call recording, transcription, and summarization to enhance visibility and efficiency of phone operations. It is also leveraging Zoom Virtual Agent for automated voice inquiry response that is available to citizens 24 by 7, and it is using multiple models alongside its proprietary models to meet requirements (e.g., accuracy, compliance, and cost) of different use cases.

Enterprises understand that the delivery of superior CX will involve different business functions that interact with customers along the buying journey. Data and AI will play a key role in delivering the CX magic. But implementation is anything but straightforward. While enterprises see the potential of agentic AI, there are still concerns around data privacy, AI governance, security, and cost. Having the right business culture and skills is equally important. This means that to accelerate the adoption of Zoom CX, Zoom will need to expand its go-to market ecosystem to help enterprises implement the solution with confidence and delivering business values. This is totally different from selling a contact center solution, which traditionally only involves the customer service function. CX specialists, systems integrators, and consulting firms are now playing a more central role in supporting enterprises in their CX transformation.

The post Zoom is Delivering Better CX by Combining Communications, AI, and Workflow into One Platform appeared first on IT Connection.

Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks have become primary platforms for hosting phishing pages and sites. Throughout 2025 and 2026, we have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This post analyzes the mechanics of a real-life adversary-in-the-middle (AitM) attack in a cloud environment and presents detailed statistics on the platforms and domains phishers abuse most frequently.

The cloud as a safe haven for phishers

Threat actors select platform-as-a-service (PaaS) offerings and distributed cloud environments to host phishing sites for much the same reasons legitimate software developers do:

• Inherent trust and reputation. Phishing pages hosted on reputable platforms appear trustworthy, reducing suspicion among potential victims.
• Most platforms offer generous free-tier developer plans. The onboarding process takes minutes and rarely requires Know Your Customer (KYC) identity verification. This enables a single operator to create hundreds of malicious accounts.
• Evasion and anonymity. Attackers leverage native security features to obscure their true origin server IP address behind a CDN, which complicates detection for security vendors.

Additionally, these platforms allocate shared subdomains hosting millions of legitimate projects and websites. Security teams cannot simply block the parent domain or its subdomains without inflicting collateral damage on bona fide users – a limitation that malicious actors take advantage of. To counter this tactic, security vendors must advance content-based analysis methodologies.

Multi-stage AitM attack

Consider a modern AitM phishing campaign that leverages Cloudflare Workers, a widely adopted cloud platform. The attackers execute the operation through multiple HTML pages distributed across a compromised website and the cloud platform. Each page serves a specific function: harvesting target email addresses, initializing the reverse-proxy infrastructure, or spoofing the login form to capture multi-factor authentication (MFA) sessions.

Stage 1. Contact harvesting and network monitoring evasion

The attack typically begins with a phishing email that uses a plausible pretext – such as a request from a coworker to review documents – to entice the target into clicking a malicious link.

Upon clicking the link, the user is redirected to a fake CAPTCHA landing page hosted on a compromised legitimate website. This specific campaign used the https://t[REDACTED]e.com website, but any other variations are possible. In this scenario, the compromised page served as a disposable relay — vendor detection mechanisms typically block phishing links delivered directly via email much faster — to prevent the early discovery of the core phishing content hosted on Cloudflare.

If the user entered their email address and clicked Continue, the pseudo-CAPTCHA marked them as a human user and initiated a redirect. The primary objective of this stage is to harvest target email addresses, filter out bots, and route legitimate users to a subdomain of workers.dev. Such subdomains are generated automatically and free of charge by Cloudflare Workers. The victim’s email address was embedded in the URL hash (the part of the URL following the # character), allowing the page at [REDACTED].workers.dev to extract the email without issuing a request to the attacker’s server, thereby avoiding detection.

Stage 2. Initializing a transparent proxy

The user’s browser then loaded a [REDACTED].workers.dev page with #user@business.com at the end of the URL. At this point, the page presented the victim with a genuine CAPTCHA challenge. This step ensured that an actual user was interacting with the page rather than a security sandbox.

Once the user successfully completed the challenge, a service worker was registered in their browser. This is a special JavaScript file capable of running in the background and intercepting all network requests generated by the current tab. As this type of script was designed as a core component of progressive web apps (PWAs) to optimize load times and support offline functionality, browsers treat service workers as standard site feature and execute them without prompting for user consent as long as the website uses an HTTPS connection.

The attackers leveraged the service worker to deploy Ultraviolet, a legitimate open-source web proxy library, to dynamically rewrite all links and forms on the page. This forced every outgoing request – including those for Microsoft login credentials – to route through the attackers’ server rather than directly to the legitimate services.

Immediately upon loading, the page extracted the victim’s email address from the URL hash and stored it in the browser’s sessionStorage property so it would not be overwritten when the CAPTCHA loaded. This step also allowed the script to pre-fill the username field in the form automatically. A pre-populated login field enhanced the page’s credibility and bolstered user trust. Once the CAPTCHA was passed, the malicious script constructed a redirect URL for the third stage, appending the email retrieved from sessionStorage back to the hash. By passing the email via the URL hash across three consecutive stages, the attackers successfully kept it hidden from network attack detection systems.

Stage 3. Session hijacking and browser window spoofing

The final stage unfolded on a third page, combining adversary-in-the-middle (AitM) traffic interception with a browser-in-the-browser (BitB) UI spoofing technique. BitB attacks operate by rendering a block inside a legitimate webpage that visually mimics a native browser pop-up window.

In this case, the script hosted on the attacker’s page generated a pop-up visually identical to a native browser window, complete with window controls and a spoofed address bar showing a trusted Microsoft URL. Within this simulated window, an iframe loaded the authentic login interface, routed dynamically through the service worker reverse proxy created in Stage 2. When the victim entered their credentials and MFA code into the BitB window, the proxy script intercepted both the credentials and the session tokens. Combining BitB with AitM significantly increases the threat: BitB provides a convincing, trusted visual wrapper (displaying a legitimate URL and branding), while the hidden AitM proxy quietly handles traffic interception and session hijacking behind the scenes.

Upon successful login, the proxy instructs the interface to close the pop-up and redirect the victim to a generic system error page, such as SessionExpired. This minimizes suspicion: the victim assumes a technical glitch occurred and attempts to log in again, unaware that the attacker already has full access to the session.

Cloud platform phishing attack statistics

We analyzed phishing URLs hosted across popular cloud platforms – including Cloudflare, Netlify, and GitHub Pages – over a 12-month period spanning August 2025 to July 2026. The data below outlines trends in unique third-level domains exploited to deliver phishing content. In total, our security solutions blocked 224,984 unique third-level domains on cloud and decentralized services used in phishing attacks within that timeframe.

Number of unique third-level domains
(download)

Based on this telemetry, we compiled a list of the TOP 10 cloud domains most frequently abused in phishing campaigns over the specified period.

Unsurprisingly, Cloudflare and Vercel emerged as the undisputed leaders: both offer free tiers, automated SSL certificate issuance, and global CDNs. GitHub Pages ranked third. The widespread legitimate use of the github.io domain complicates bulk blocking efforts, as security teams risk limiting access to non-malicious projects.

Decentralized networks also warrant close attention – we posted on this subject in 2023. The ipfs.io and dweb.link domains function as IPFS gateways. The principal risk associated with these platforms is content persistence: even if a specific gateway gets blocked, the phishing page remains accessible via alternative nodes across the network.

The visual website builders Wix and Webflow also ranked among the TOP 10 (eighth and ninth, respectively). These platforms allow low-skilled individuals to build phishing pages rapidly without advanced coding expertise, which significantly lowers the barrier to entry for less capable malicious actors.

 

	Domain	Number of phishing links	Platform
1	pages.dev	24.9%	Cloudflare Pages
2	vercel.app	13.8%	Vercel
3	github.io	13.7%	GitHub Pages
4	netlify.app	10.0%	Netlify
5	dweb.link	7.8%	IPFS gateway
6	ipfs.io	5.3%	IPFS (InterPlanetary File System)
7	workers.dev	2.5%	Cloudflare Workers
8	wixstudio.com	1.9%	Wix Studio
9	webflow.io	1.0%	Webflow
10	azurewebsites.net	1.0%	Microsoft Azure
	Other	17.9%

In total, we identified and neutralized over 390,000 phishing pages hosted across legitimate cloud platforms and decentralized networks (IPFS) over the past 12 months. This data confirms that threat actors actively exploit the implicit trust associated with legitimate PaaS providers (such as Cloudflare Workers, Vercel, Netlify, and GitHub Pages) and IPFS gateways. High domain reputation, generous free tiers, and built-in evasion capabilities enable phishers to deploy multi-stage AitM attacks designed to hijack MFA sessions.

Recommendations

Traditional security controls, such as relying on HTTPS lock icons or reputation-based domain denylists, are inadequate against these attacks. The cloud provider’s apex domain maintains a positive reputation score, while attackers generate malicious subdomains programmatically and at scale.

Effective defense against these threats calls for a layered security posture:

• Exercise caution with unexpected requests, even if they are served from reputable domains or secured with valid SSL/TLS certificates.
• Treat any CAPTCHA interface requiring personal data input as a possible scam. Legitimate CAPTCHA challenges rarely request personally identifiable information, such as email addresses.
• Inspect the URL in the address bar at the very top of the browser window. In BitB attacks, threat actors can render a fake browser pop-up displaying any target URL, even a legitimate one. However, the true address bar – located at the top of the main browser window alongside native navigation controls (Back, Forward, Refresh) – will continue to display the actual attacker-controlled domain.
• Avoid entering credentials in pop-ups you did not expect to see. If a login or MFA form appears without your explicit action, close the tab immediately. Navigate to the intended service manually by entering its address directly into the browser.
• Additional protection can be provided by Kaspersky Secure Mail Gateway for enterprise environments and Kaspersky Premium for personal correspondence. These robust email security solutions neutralize phishing links at the delivery stage before they reach the inbox.

Summary Bullets:

• Boomi is evolving from an iPaaS into an enterprise platform combining integration, automation, API management, data management, and AI agent governance.

• GlobalData recently attended Boomi’s World Tour London 2026, where agentic AI was discussed at length around announcements including Boomi Connect, Boomi Orchestrate, and Boomi Companion.

Although Boomi has historically been best known as an integration platform as a service, or iPaaS, the company is going to great lengths to emphasize that it has evolved into an enterprise platform which activates data and workflows for customers and combines integration, automation, API management, data management, and AI-agent governance. The Boomi platform acts as the connective and orchestration layer between an organization’s applications, data, and AI systems, but is increasingly moving towards management of AI agents to help data enhance business processes.

The company is investing significant resources in its Runtime environment, a hybrid platform that customers can install either locally or in a virtual private cloud. Integration is an area of major focus for the vendor, with plans to bring all business workloads into Runtime, including workflows, AI agents, and eventually small language models. Boomi has a partnership with Red Hat to help manage the deployment of open-weight and proprietary models.

Boomi is not tied to a particular ecosystem, in the vein of providers such as ServiceNow; rather, it offers an independent API control pane across all ecosystems. For example, it can connect Salesforce with SAP, synchronize customer records, automate an order-to-cash process, expose the process as an API, send transactions to suppliers through EDI, and now help AI agents replicate the same process.

The company is expanding not just beyond integration but across all platform services including investments in data readiness with Meta Hub, with strong traction among customers thanks to the growing popularity of data management systems. Currently in preview, the Knowledge Hub will also allow customers to bring unstructured data into the platform.

In the realm of agentic solutions, Boomi has recently announced new products including Boomi Connect, Boomi Orchestrate, and Boomi Companion:

• Boomi Connect offers the governance layer, sitting between the AI layer and the enterprise applications in the customer organization, with secure access, tool scoping, and observability, connecting and integrating MCP and governance by creating a single stack for CSOs. It establishes secure connections between AI tools (Claude, Copilot, and Gemini) and enterprise applications thanks to more than 1,000 MCP-enabled tools.

• Boomi Orchestrate brings IT, business applications and agents together to solve complex problems by creating blueprints allowing customer teams to build solutions. While agentic platforms are quickly becoming commoditized, Boomi has focused on delivering its proprietary offering in a way that meets customer requirements.

• Boomi Companion enables existing AI tools to design, build, test, deploy, and diagnose Boomi integrations in natural language. It transforms prompts into integrations in any language the AI agent supports and offers AI-assisted development with Claude Code, Cursor, and more via open-source Agent Skills standard.
Boomi is also launching Boomi Prompt, although the release date is yet to be determined. Boomi Prompt will form a layer of intelligent routing that is not limited to routing the LLM but will route, sort out, and separate deterministic from probabilistic workflows so users do not waste tokens. This promises, when it comes out, to be a strong portfolio addition to help customers mindful of “tokenomics”, the management of costs driven by AI consumption.

Agent Studio, introduced last May, is an agent management platform for customers who have been undertaking integration processes for 20 years and do not want to start over with agents and replace everything. These types of enterprises are looking for slightly augmented intelligence to leverage agents for fixing things that are not working. Rather than starting over, they favor an integration process for testing applications. Customers are used to deterministic workflows and the Agent Studio offers an integration workflow in an structured form.

Boomi is focusing on the right objectives. In terms of governance, the company is in a solid position to benefit from a significant opportunity in the next two years as token budgets get out of control to help people to get back into deterministic processes and bring non-deterministic workflows back under control.

The caveat is that the portfolio is becoming very broad. Integration remains Boomi’s most mature and recognizable capability, while advanced data engineering, enterprise knowledge and agent-management products are newer expansion areas. Many customers may still look at the Boomi platform primarily as an enterprise connectivity and orchestration platform, but its advancements in agentic AI management should not be overlooked.

The post Boomi Targets Agentic AI Governance, but Orchestration Remains Its Raison d’Etre appeared first on IT Connection.