Researchers Trace 60,000-Plus Phishing Links Abusing Cloudflare Services
Summary
Hunt researchers found more than 60,000 phishing links, many targeting Microsoft SharePoint and Office 365 credentials. The pages used a shared Font Awesome kit and Cloudflare Workers or IPFS gateways to host credential-harvesting content.
Key points
- A shared Font Awesome kit helped researchers identify the cluster of more than 60,000 phishing links.
- Many pages impersonated Microsoft SharePoint or Office 365; others imitated Adobe, DHL, email providers, Mercari, and LinkedIn.
- The operators used Cloudflare Workers or Cloudflare IPFS gateways to host or distribute phishing pages; a handful used neither.
- One Adobe-themed page collected email and password entries and sent them to a credential-collection endpoint; that endpoint was no longer responding when the article was written.
- A Microsoft Word-themed page used an IPFS gateway, offered multiple email-provider login options, and sent entered credentials to an external endpoint.
- The article recommends adaptive security solutions, including anomaly detection that identifies unusual traffic patterns.
Article Details
- Attack Vectors
- Phishing pages imitated Microsoft SharePoint and Office365 login pages, as well as pages for DHL, Webmail Panels, Mercari, Adobe, and other services.
- The pages used Cloudflare Workers or Cloudflare IPFS Gateways to host or distribute phishing content.
- Scripts collected email addresses and passwords from submitted forms and sent credentials to remote PHP endpoints.
- A shared Font Awesome kit appeared across many phishing pages.
- Defensive Notes
- The article recommends anomaly detection that analyzes traffic patterns and identifies deviations from normal behavior.
- The shared Font Awesome kit was used to identify a cluster of phishing pages.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | ogukbm[.]nmbzts2qjn2150[.]workers[.]dev | Cloudflare Workers hostname hosting a phishing page that impersonated an Adobe document and collected email credentials. |
| URL | hxxps[:]//ugiuk[.]dyndns[.]dk/sign4/Adobe.php | Credential-submission endpoint used by the phishing page impersonating an Adobe document. |
| URL | hxxps[:]//usefuxoil[.]shop/high/boloadobe.php | Credential-submission endpoint used by the phishing page targeting Office365 credentials. |
MITRE ATT&CK
Vendors
Products
Cloudflare IPFS Gatewaysit's only fitting that they use their services. In this activity set, the scammers used either Cloudflare IPFS Gateways, distributing content from a decentralized network, or Cloudflare Workers, a serverlessCloudflare Workersused either Cloudflare IPFS Gateways, distributing content from a decentralized network, or Cloudflare Workers, a serverless execution environment, to mask their malicious intent. *A handful do not use eitherFont AwesomeWhat tipped us off? A shared Font Awesome kit across a massive number of websites hosting fake login pages. This discovery led us to over 60,000 links, most targeting login credentials for Microsoft's SharePoint andMicrosoft SharePointpages. This discovery led us to over 60,000 links, most targeting login credentials for Microsoft's SharePoint and Office365 platforms. The campaign wasn't limited to Microsoft products; we've also encounteredOffice365discovery led us to over 60,000 links, most targeting login credentials for Microsoft's SharePoint and Office365 platforms. The campaign wasn't limited to Microsoft products; we've also encountered pages imitating