FlagThis

Cybercriminals are exploiting Cloudflare's Pages (.dev) and Workers (.dev) platforms for malicious activities, leveraging Cloudflare's trusted reputation to enhance the success of their attacks. These platforms, intended for legitimate web development and deployment, are being misused to host phishing attacks, malicious web pages, and targeted email lists. This abuse highlights the risk of attackers leveraging reputable services for nefarious purposes, thereby increasing the likelihood of unsuspecting users falling victim to their schemes. The attackers are exploiting Cloudflare's global reach and security features to make their phishing campaigns appear more legitimate and harder to detect.

Security analysts at FORTRA have reported an explosive growth in phishing attacks utilizing Cloudflare Pages and Workers. Specifically, a 198% increase in attacks targeting Cloudflare Pages and a 104% surge in attacks against Cloudflare Workers were observed. These attacks utilize various techniques, including the use of bccfoldering to hide recipient lists in email campaigns and the creation of CAPTCHA-like human verification pages to add an air of legitimacy to phishing attempts. The ease of use and free hosting offered by Cloudflare, combined with features like SSL/TLS encryption, custom domains, and URL masking, make these platforms particularly attractive to malicious actors.

The increasing abuse of Cloudflare's developer domains underscores the need for enhanced security measures and vigilance. Attackers are taking advantage of Cloudflare's trusted infrastructure and reverse proxy capabilities to make their attacks more difficult to trace and detect. This highlights the challenge of balancing the benefits of accessible developer platforms with the need to mitigate their potential for misuse. The significant increase in phishing attacks using these platforms emphasizes the urgency for both Cloudflare and users to adapt to this evolving threat landscape and implement stronger protective measures.

ImgSrc: www.techzine.eu

References:

• Cyber Security News - Cybercriminals are increasingly exploiting Cloudflare Pages (Pages.dev) and Workers (Workers.dev) for phishing and other attacks, leveraging Cloudflare’s trusted reputation and services for maliciou - 23d
• @neurovagrant - My toot is lost to time due to autodelete, but two months ago I called out* a major uptick in malicious actors using Cloudflare's pages[.]dev to attack people. Looks like Fortra dove deep on it, final - 23d
• Techzine Global - Explosive growth in phishing via Cloudflare Pages and Workers - 23d
• GBHackers Security - Cloudflare Developer Domains Abused For Cyber Attacks - 23d
• Over Security - Hackers use Cloudflare to deploy malware - 23d

Classification:

• HashTags: Cloudflare Phishing CloudSecurity
• Company: Cloudflare
• Target: Cloudflare users
• Product: Cloudflare Pages and Workers
• Feature: Pages and Workers
• Type: Hack
• Severity: Medium