Better Security, Together

Cybercriminals are increasingly exploiting Cloudflare’s trusted domains for phishing and other malicious activities. Reports indicate a sharp rise in abuse, with incidents increasing by 100% to 250% compared to 2023. This trend highlights how attackers leverage Cloudflare’s brand credibility, service reliability, and reverse proxying capabilities to bypass detection systems and make their campaigns appear legitimate. These domains have become popular for hosting phishing pages, launching distributed denial-of-service (DDoS) attacks, and injecting malicious scripts.

Cloudflare Pages, a platform for hosting scalable websites, and Cloudflare Workers, a serverless computing solution, have been exploited for hosting fake login sites and conducting credential-stealing campaigns. Phishing incidents on Cloudflare Pages have surged by nearly 200%, with attackers commonly hosting intermediary phishing pages that redirect users to malicious sites. Similarly, abuse of Cloudflare Workers has increased by over 100%, including tactics like hosting fake verification steps to deceive users. Attackers also use techniques like “bccfoldering” in phishing campaigns to conceal their scale, this method hides recipients by including them in the email envelope but not the headers.

Cybersecurity researchers have identified a new phishing campaign that employs corrupted Microsoft Office documents and ZIP archives to bypass email security mechanisms. This tactic allows attackers to evade antivirus software, avoid sandbox detection, and slip through Outlook’s spam filters. The corrupted nature of these files prevents them from being flagged as malicious by security tools.

The campaign involves emails with ZIP or Office attachments intentionally corrupted to render them unscannable. These messages often use enticing themes, such as employee benefits or bonuses, to lure recipients into opening them. Despite the corruption, programs like Word, Outlook, and WinRAR can use their built-in recovery features to open these damaged files in recovery mode. Once opened, the documents often embed QR codes that redirect victims to malicious websites or fake login pages, facilitating malware deployment or credential theft.