Dangling DNS records pointing to unclaimed cloud resources allow attackers to register those resources and serve malicious content under the victim's domain, enabling phishing, cookie theft, and CORS bypass.
Immediate Response
1Remove dangling DNS records for decommissioned services immediately.
2If the subdomain has been claimed by an attacker, request takedown through the cloud provider.
3Audit all DNS records to identify other potentially dangling entries.
4Notify users if the takeover enabled phishing or credential theft.
