{"success":true,"data":{"id":"vercel-app-pdf-viewer-lure","label":"Phishing page hosted on *.vercel.app subdomain disguised as PDF or document viewer","description":"Phishing page hosted on a *.vercel.app free-tier subdomain disguised as a PDF or document viewer. Vercel's free tier allows any user to deploy at <project>.vercel.app, sharing the vercel.app HTTPS certificate and CDN trust reputation. Attackers deploy a credential-harvesting form styled as an invoice / contract / document viewer at a subdomain (e.g. invoice-review-xyz.vercel.app) and send an email claiming there is a shared document awaiting review or signature. The signal fires when: (1) a link to *.vercel.app (not vercel.com) appears in the body AND (2) a document / PDF / invoice / contract viewing narrative is present AND (3) sender is NOT from vercel.com. Distinct from the CI-publisher trust family — this targets credential-harvesting-page-hosting abuse, not CI trust manipulation. Source: GC1 R12 council #2; Vercel abuse reports 2025-2026; APWG eCrime 2025; Proofpoint threat intelligence 2026.","tier":"danger","category":"other","isThin":false}}