{
  "name": "Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling",
  "slug": "phishing-with-cloudflare-workers-transparent-phishing-and-html-smuggling",
  "description": "Netskope Threat Labs has been tracking an increase in phishing campaigns hosted on Cloudflare Workers. The campaigns use techniques like HTML smuggling and transparent phishing to evade detections. The phishing pages target Microsoft and Google credentials. Netskope recommends inspecting web traffic to detect and block phishing sites.",
  "published": "2024-05-28T10:36:26+00:00",
  "created_at": "2024-05-28T10:36:26+00:00",
  "modified_at": "2024-05-28T10:59:56+00:00",
  "created_at_opencti": "2024-05-28T10:36:26+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-28",
    "cloudflare workers",
    "credential-theft",
    "html smuggling",
    "phishing"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "yellow-recipe-c615.wl5n4b9b.workers.dev"
      },
      {
        "id": "",
        "name": "wood-82c2.jayden1077.workers.dev"
      },
      {
        "id": "",
        "name": "voice-chat-e42b.gzklq0kj.workers.dev"
      },
      {
        "id": "",
        "name": "wilmse-d767.eoethehorbmnlkntua.workers.dev"
      },
      {
        "id": "",
        "name": "uniame-2818.carirentfrsae.workers.dev"
      },
      {
        "id": "",
        "name": "ungamj-98bc.neglmlnaay.workers.dev"
      },
      {
        "id": "",
        "name": "undec-ab94.djuleircendku.workers.dev"
      },
      {
        "id": "",
        "name": "ueana-a505.ncaielazulep.workers.dev"
      },
      {
        "id": "",
        "name": "still-poetry-77cd.uitsnnassdtaa3215.workers.dev"
      },
      {
        "id": "",
        "name": "shiny-bar-1128.javion1086.workers.dev"
      },
      {
        "id": "",
        "name": "shhared-sea-d6d3.krystengraff.workers.dev"
      },
      {
        "id": "",
        "name": "sheetrm-1c7f.krystengraff.workers.dev"
      },
      {
        "id": "",
        "name": "sheets-term-2b6f.amariruth.workers.dev"
      },
      {
        "id": "",
        "name": "sheetg-a014.tyron1133.workers.dev"
      },
      {
        "id": "",
        "name": "sharedsing-2723.emmalopes.workers.dev"
      },
      {
        "id": "",
        "name": "sheeetss-99b3.sbretasaheliba.workers.dev"
      },
      {
        "id": "",
        "name": "shared-grass-549a.uriahmontague.workers.dev"
      },
      {
        "id": "",
        "name": "share-wcloud-4b35.uytsaiteqcnljwr.workers.dev"
      },
      {
        "id": "",
        "name": "share-one-paper-46a2.rilceharrlyeav.workers.dev"
      },
      {
        "id": "",
        "name": "run-sun-a3dc.santanaharmon.workers.dev"
      },
      {
        "id": "",
        "name": "shadoc-unit-d523.einureqbaftjc.workers.dev"
      },
      {
        "id": "",
        "name": "share-field-7570.yralecaeaghnrsn.workers.dev"
      },
      {
        "id": "",
        "name": "recore-3b5e.ilimamecasm.workers.dev"
      },
      {
        "id": "",
        "name": "reconnec-tree-fb13.aybnmmtiluah.workers.dev"
      },
      {
        "id": "",
        "name": "rondoc-b7ce.lvauayt.workers.dev"
      },
      {
        "id": "",
        "name": "proposal-ce2a.cullen1015.workers.dev"
      },
      {
        "id": "",
        "name": "pucoby-5cc9.idkiahstknaa.workers.dev"
      },
      {
        "id": "",
        "name": "projeeect-sunset-27f3.citlaliheck.workers.dev"
      },
      {
        "id": "",
        "name": "project-base-4b4d.tierfaitneuro.workers.dev"
      },
      {
        "id": "",
        "name": "profile-auth-51b7.s9afo8oi.workers.dev"
      },
      {
        "id": "",
        "name": "penca-cbd8.ilodnswfalen.workers.dev"
      },
      {
        "id": "",
        "name": "orange-math-f65b.naacraleindir.workers.dev"
      },
      {
        "id": "",
        "name": "oudslc-docs-4c58.pchgpwahni.workers.dev"
      },
      {
        "id": "",
        "name": "orebu-cloud-3bde.lwvemrlaensi.workers.dev"
      },
      {
        "id": "",
        "name": "nuclo-b1bb.laseiphnel.workers.dev"
      },
      {
        "id": "",
        "name": "onionss-78f4.eihnialonmfre.workers.dev"
      },
      {
        "id": "",
        "name": "omudipe-3e72.itrlcuvapioelcr.workers.dev"
      },
      {
        "id": "",
        "name": "munal-ed0b.lsoysraiae.workers.dev"
      },
      {
        "id": "",
        "name": "misty-pond-905a.skniapeoosrp4335.workers.dev"
      },
      {
        "id": "",
        "name": "mursu-e366.irakfflazrtgy.workers.dev"
      },
      {
        "id": "",
        "name": "messges-bar-9caa.yilurqr6.workers.dev"
      },
      {
        "id": "",
        "name": "lucky-mountain-1a8a.88d2jrux.workers.dev"
      },
      {
        "id": "",
        "name": "lucky-cloud-09ff.gehabumferv.workers.dev"
      },
      {
        "id": "",
        "name": "inv-shee-0d26.ieislnqveulte.workers.dev"
      },
      {
        "id": "",
        "name": "late-river-17c7.pn2dotnx.workers.dev"
      },
      {
        "id": "",
        "name": "jundoc-sunset-a630.trumneannmseretan.workers.dev"
      },
      {
        "id": "",
        "name": "hycloud-c6f3.ylunndoiclrdaa.workers.dev"
      },
      {
        "id": "",
        "name": "inboxx-89f1.nkbrehmyetae.workers.dev"
      },
      {
        "id": "",
        "name": "id-dew-ad5f.gzklq0kj.workers.dev"
      },
      {
        "id": "",
        "name": "hero-thunder-ef0c.lexiegamboa.workers.dev"
      },
      {
        "id": "",
        "name": "heets-sun-8ff8.bethbess.workers.dev"
      },
      {
        "id": "",
        "name": "haluuu.aardhnrscidcahr.workers.dev"
      },
      {
        "id": "",
        "name": "greg-56e7.lleabtiswhe.workers.dev"
      },
      {
        "id": "",
        "name": "ground-violet-e1ad.jackreedy.workers.dev"
      },
      {
        "id": "",
        "name": "grehu-6d48.aedlripreaz.workers.dev"
      },
      {
        "id": "",
        "name": "gentle-feather-d68f.ansley1024.workers.dev"
      },
      {
        "id": "",
        "name": "green-shared-211d.ecormllhoi.workers.dev"
      },
      {
        "id": "",
        "name": "gentle-voice-fa8b.epd5tuee.workers.dev"
      },
      {
        "id": "",
        "name": "generals-dawn-cf0d.dnayipmrindk.workers.dev"
      },
      {
        "id": "",
        "name": "frosty-document-5022.dscgs8xo.workers.dev"
      },
      {
        "id": "",
        "name": "geea-d27e.elrtuearsddecul.workers.dev"
      },
      {
        "id": "",
        "name": "fragrant-mode-6a69.trnnnraibaomti.workers.dev"
      },
      {
        "id": "",
        "name": "field-6344.kaley1087.workers.dev"
      },
      {
        "id": "",
        "name": "filrem-clouds-f600.larerercgbanelu.workers.dev"
      },
      {
        "id": "",
        "name": "falling-hall-35ca.bzefiragnloe1965.workers.dev"
      },
      {
        "id": "",
        "name": "fancy-cherry-de6f.8n2jthl6.workers.dev"
      },
      {
        "id": "",
        "name": "enjucm-6424.anotudhoeah.workers.dev"
      },
      {
        "id": "",
        "name": "encaon-568f.adademord.workers.dev"
      },
      {
        "id": "",
        "name": "egfyua-winter-sea-8755.smilingpurple.workers.dev"
      },
      {
        "id": "",
        "name": "dry-scene-66f4.so3yeui8.workers.dev"
      },
      {
        "id": "",
        "name": "dooocss-5d06.uerupmmllyd.workers.dev"
      },
      {
        "id": "",
        "name": "drecloud-1fce.eteispafntejrntan.workers.dev"
      },
      {
        "id": "",
        "name": "doooc-cebf.rglegagaoali.workers.dev"
      },
      {
        "id": "",
        "name": "doocloud-323b.teerhanlnuchmar.workers.dev"
      },
      {
        "id": "",
        "name": "doccc-inv-5685.fsealerly.workers.dev"
      },
      {
        "id": "",
        "name": "dooc-dar-b916.slrheeibtuebsid.workers.dev"
      },
      {
        "id": "",
        "name": "dhocs-haze-a290.nuiblalrlewln.workers.dev"
      },
      {
        "id": "",
        "name": "danu-8a19.nldatwuiassdreeio.workers.dev"
      },
      {
        "id": "",
        "name": "dark-river-79b4.jamar1026.workers.dev"
      },
      {
        "id": "",
        "name": "d0ocs-ow-9c42.nganarxnksoroo.workers.dev"
      },
      {
        "id": "",
        "name": "crownjul-dreasm-7206.olinltjsacnrai.workers.dev"
      },
      {
        "id": "",
        "name": "crimson-flower-941f.3invyzig.workers.dev"
      },
      {
        "id": "",
        "name": "crimson-cell-4c00.9kgfjtlv.workers.dev"
      },
      {
        "id": "",
        "name": "crdoc-term-8097.kasrhienddnhasae.workers.dev"
      },
      {
        "id": "",
        "name": "coreplesk-cake-7dbf.leacshlenmmdgza.workers.dev"
      },
      {
        "id": "",
        "name": "core-bonus-3844.caileymcclendon.workers.dev"
      },
      {
        "id": "",
        "name": "clouuu-1faa.uicnotksbreal.workers.dev"
      },
      {
        "id": "",
        "name": "cold-frost-1951.enktcrljfezatoa6437.workers.dev"
      },
      {
        "id": "",
        "name": "clouuss-c438.eniatolitse.workers.dev"
      },
      {
        "id": "",
        "name": "clouud-1ea1.ehebarotnittk.workers.dev"
      },
      {
        "id": "",
        "name": "clouuds-haze-bca9.esalasaimr-c19.workers.dev"
      },
      {
        "id": "",
        "name": "cloudsss-e610.rnailruarffoi.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-tree-bbeb.lexiegamboa.workers.dev"
      },
      {
        "id": "",
        "name": "clous-lab-662a.tlavaeonryersvs.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-scene-ed7a.emiliafalk.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-tain-fce5.cmcayeyuhnaess.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-scene-ad2d.alessandraquinn.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-pine-bd47.iodoeamnnsc.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-ocd-87e8.nswoadaas.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-inv-2f38.oednlakueupsap.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-frog-f374.yralecaeaghnrsn.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-cake-4525.teairncakli.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-bird-906f.inlukbatehret.workers.dev"
      },
      {
        "id": "",
        "name": "cloude-dd47.aeancsesekhi.workers.dev"
      },
      {
        "id": "",
        "name": "cloudl-191c.aoapuulz.workers.dev"
      },
      {
        "id": "",
        "name": "clouds-33b3.citlaliheck.workers.dev"
      },
      {
        "id": "",
        "name": "cloudd-9049.tolevilmtohean.workers.dev"
      },
      {
        "id": "",
        "name": "cloude-15e5.karsonjacobsen.workers.dev"
      },
      {
        "id": "",
        "name": "clouddd-1d8c.eleutamdcdla.workers.dev"
      },
      {
        "id": "",
        "name": "cloudd-5d85.eatsosyannatr.workers.dev"
      },
      {
        "id": "",
        "name": "cloud-new-grass-82b7.ptakptasyenlki.workers.dev"
      },
      {
        "id": "",
        "name": "cloud-init-8373.nuzsidlneae.workers.dev"
      },
      {
        "id": "",
        "name": "cloud-base-3540.jalincrowe.workers.dev"
      },
      {
        "id": "",
        "name": "cloud-connectors-a7ad.liis6wf5.workers.dev"
      },
      {
        "id": "",
        "name": "cloud-3300.lnrtygtenaeailce.workers.dev"
      },
      {
        "id": "",
        "name": "cloouds-bar-84ac.slrheeibtuebsid.workers.dev"
      },
      {
        "id": "",
        "name": "cloosud-776c.lnskeaysldoavar.workers.dev"
      },
      {
        "id": "",
        "name": "cloicel-8251.uckldadoaierbex.workers.dev"
      },
      {
        "id": "",
        "name": "chatss-feather-5154.eebufrdrrmsngueum.workers.dev"
      },
      {
        "id": "",
        "name": "chaaat-a150.ahiamsomkyyuo.workers.dev"
      },
      {
        "id": "",
        "name": "chare-docs-a528.rdleajodex.workers.dev"
      },
      {
        "id": "",
        "name": "blou-79bc.hedozriikbe.workers.dev"
      },
      {
        "id": "",
        "name": "bitter-glitter-3cd5.epd5tuee.workers.dev"
      },
      {
        "id": "",
        "name": "basedbar-df19.joanapatterson.workers.dev"
      },
      {
        "id": "",
        "name": "autumn-recipe-1448.5o662488.workers.dev"
      },
      {
        "id": "",
        "name": "autumn-haze-7b45.fhzpzvz6.workers.dev"
      },
      {
        "id": "",
        "name": "assets-wind-7719.coralcleary.workers.dev"
      },
      {
        "id": "",
        "name": "asset-meadow-2e67.karsonjacobsen.workers.dev"
      },
      {
        "id": "",
        "name": "aged-sunset-c81b.debra1027.workers.dev"
      },
      {
        "id": "",
        "name": "aoelc-0218.ralaeyrifh.workers.dev"
      },
      {
        "id": "",
        "name": "ancient-smoke-63e4.95lolkc8.workers.dev"
      },
      {
        "id": "",
        "name": "aged-meadow-3eab.iywxz2kh.workers.dev"
      },
      {
        "id": "",
        "name": "a0tuh-do.uhirrc.workers.dev"
      },
      {
        "id": "",
        "name": "aemus-a2b8.buaiteircsskeor.workers.dev"
      }
    ],
    "attack_patterns": [
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      }
    ]
  },
  "external_refs": [
    "https://www.netskope.com/blog/phishing-with-cloudflare-workers-transparent-phishing-and-html-smuggling",
    "https://otx.alienvault.com/pulse/6655cfcbf3aed7004fc047e4"
  ]
}