Cloudflare

Reported Context (7)

"When visiting such a site, users were shown a forged Cloudflare verification page that, under the pretext of confirming the visitor is human, prompted them to execute a command," CERT-UA said in an advisory. "Executing Fake Cloudflare Checks on 100+ Compromised Websites Deliver LunexStealer
their subscription or use the "backup" domain, which is a Google Sites link. That link goes to a fake Cloudflare landing page with a fake CAPTCHA, where the user ultimately gets a standard ClickFix prompt to kick off Malicious ChatGPT Custom GPTs Deliver RATs Through ClickFix Attack
Russian, and the AI wrote the server, deployed it on a new VPS, configured the infrastructure, set up Cloudflare tunnels, managed the bots, debugged connectivity problems, and even suggested using an idle bot. Threat Actor Used Gemini CLI to Build and Operate a Botnet in Minutes
Three domains, registered within the same 48-hour window and hosted on Cloudflare, impersonating the AWS login page and used adversary-in-the-middle (AiTM) techniques to capture multi-factor authentication (MFA) codes AiTM Phishing Kit Targets AWS Console Credentials and MFA Codes
In the anatomy of one busy working day, Gemini deployed servers, helped debug code, automated workflows, wrote a script to rotate API keys, and managed the actor’s Cloudflare tunnels. Research Details AI-Assisted ‘Patriot Bait’ Campaign Using Telegram Scams and Credential Theft

Malware (11)

People (11)

Threat Actors (6)

MITRE ATT&CK (35)

Vendors (10)

Products (40)

Tools (12)

Industries (8)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.