Russian-Speaking Threat Actor Abuses Cloudflare & Telegram in Phishing Campaign

An open directory tied to EFF-impersonating actors targeting Albion Online players exposed decoy documents and Stealc/Pyramid C2 malware; shared SSH keys linked 11 more servers.

Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.

One shared Font Awesome kit helped Hunt.io uncover 60,000+ phishing links on Cloudflare Workers and IPFS gateways, mostly fake Microsoft SharePoint/Office365 logins plus DHL and webmail lures.

Hunt details a Telegram phishing campaign impersonating venture staff to target blockchain entrepreneurs, delivering malicious AppleScript via fake meeting links, mirroring Lazarus tactics.

How ambiguous NGINX cache keys can enable access-control bypasses, cache deception, CPDoS, stored XSS and origin cache poisoning.

HackerOne launched Gateway Internal Network Testing (INT), built on Cloudflare ZTNA to let researchers test internal assets through zero-trust tunnels with logging and TLS decryption.