PHISHING WITH CLOUDFLARE WORKERS: TRANSPARENT PHISHING AND HTML SMUGGLING

Summary from the TLDR InfoSec newsletter

Netskope Threat Labs is tracking two common phishing techniques that have been observed in phishing campaigns that utilize Cloudflare Workers. Attackers are utilizing Cloudflare Workers to deliver an encoded blob, which is reconstructed on the client to execute HTML smuggling attacks. Attackers are also utilizing Cloudflare Workers for transparent phishing attacks, creating MitM channels where attackers can intercept victims' credentials and MFA while relaying them to a destination server.