How Threat Actors Abuse Cloudflare Services for Phishing and Malware Delivery
Summary
Cofense describes Cloudflare Workers used for AiTM credential phishing and TryCloudflare Tunnels for malware delivery. A reported chain uses URL shortcuts, WebDAV, WSF and batch scripts to install Xeno RAT or XWorm RAT; Cloudflare uses behavioral detection, CAPTCHA and,
Key points
- Threat actors use Cloudflare Workers to host credential-phishing pages, including adversary-in-the-middle pages that imitate legitimate sign-in portals.
- Cofense reports that free TryCloudflare Tunnels are used to expose locally hosted malicious content and obscure attacker infrastructure.
- A described delivery chain begins with an emailed URL shortcut, which retrieves a WSF file and triggers batch scripts that deliver a Python installer and Xeno RAT or XWorm RAT.
- WebDAV and drive-mapping techniques can make malicious files appear as ordinary network shares; the article says this can help evade sandbox detection.
- Cofense says Cloudflare’s reputation and automatic HTTPS can help malicious pages evade email and network defenses.
- Cofense reports a peak in Cloudflare Workers and Tunnels phishing and malware activity in 2025 compared with its tracking since 2021.
- The article says Cloudflare uses behavioral and machine-learning detection, dynamic CAPTCHA, malicious-IP blocking and internal audits to address abuse.
Article Details
- Topic
- Abuse of Cloudflare Workers and Tunnels to host credential-phishing pages and deliver malware
MITRE ATT&CK
T1021 · Remote ServicesWebDAV and drive-mapping techniques present malicious files as network shares for delivery.T1059 · Command and Scripting InterpreterWSF files and batch scripts execute commands and install Python-based payloads, including Xeno RAT and XWorm RAT.T1105 · Ingress Tool TransferThe infection process retrieves malicious files and payloads from Cloudflare-associated addresses and WebDAV servers.T1204 · User ExecutionOpening a malicious URL shortcut file starts the infection chain by retrieving a WSF file.T1566 · PhishingCloudflare Workers are used to host credential-phishing and AiTM pages that imitate sign-in interfaces.T1572 · Protocol TunnelingThreat actors abuse Cloudflare Tunnels to create temporary, obfuscated connections that expose locally hosted malicious content.
Malware
XenoRATCloudflare services — particularly Workers and Tunnels — are being abused by threat actors to host convincing AiTM phishing pages and to stage covert connections that deliver malware, including Xeno RAT and XWorm RAT.XWormCloudflare services — particularly Workers and Tunnels — are being abused by threat actors to host convincing AiTM phishing pages and to stage covert connections that deliver malware, including Xeno RAT and XWorm RAT.
Vendors
Products
Cloudflare PagesCloudflare Pages (*[.]pages[.]dev) and Cloudflare R2 (*[.]r2[.]dev) belong to Cloudflare’s developer platform and are widely used for static site hosting and object storage, respectively.Cloudflare R2Cloudflare’s suite of services like Workers, Tunnels, Turnstile, Pages and Cloudflare R2 (*[.]r2[.]dev) continue to be abused by threat actors to orchestrate stealthy phishing attacks and deliver malware in ways thatCloudflare TunnelsCloudflare Tunnels (TryCloudflare) are abused to create obfuscated, temporary connections that expose locally hosted malicious content and deliver RATs and information stealers.Cloudflare WorkersThreat actors exploit Cloudflare Workers to host adversary-in-the-middle (AiTM) and credential-phishing pages that mimic legitimate login portals.TryCloudflareThese attacks leverage trusted Cloudflare domains and free tiers (e.g., *.workers[.]dev, *.trycloudflare[.]com, *.pages[.]dev, *.r2[.]dev) to bypass email and network defenses and evade detection.