Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling

Text acquired from the source

Evento MISP pubblicato con TLP:CLEAR: Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling. Report from - [URL rimossa] (1717011547) Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling ========================================================================= May 23 2024 By [Jan Michael Alcantara]([URL rimossa]) Summary ------- Netskope Threat Labs is tracking multiple phishing campaigns that abuse Cloudflare Workers. The campaigns are likely the work of different attackers since they use two very different techniques. One campaign (similar to the [previously disclosed]([URL rimossa]) Azorult campaign) uses HTML smuggling, a detection evasion technique often used for downloading malware, to hide the phishing content from network inspection. The other uses a method called transparent phishing, where the attacker uses Cloudflare Workers to act as a reverse proxy server for a legitimate login page, intercepting traffic between the victim and the login page to capture credentials, cookies, and tokens. Netskope Threat Labs has been tracking an increasing number of Netskope users targeted by malicious content hosted in Cloudflare Workers throughout 2023 and into 2024. The number of targeted users appears to have leveled off so far in 2024, although the number of domains continues to increase. At the same time, the distinct number of applications hosting the malicious content continues to increase, indicating that attackers are constantly creating new ap