Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exposing Massive Phishing Scams Abusing Cloudflare Services

hunt.io | blog | #credential-theft | #microsoft | #phishing | #cloudflare | #font-awesome | #ipfs

Summary

One shared Font Awesome kit helped Hunt.io uncover 60,000+ phishing links on Cloudflare Workers and IPFS gateways, mostly fake Microsoft SharePoint/Office365 logins plus DHL and webmail lures.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66
Over 1,465 energy-sector phishing detections in a year: Chevron, ConocoPhillips, PBF and Phillips 66 cloned via HTTrack, blending credential theft with investment scams, and missed by most vendors.
blog · hunt.io
ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis
Hunt.io obtained the full ERMAC V3.0 source code, exposing critical weaknesses like a hardcoded JWT secret and expanded form injection targeting 700+ financial and crypto apps.
blog · hunt.io
Server-Side Phishing: How Credential Theft Campaigns Are Hiding in Plain Sight
A phishing campaign targeting employee and member portals now validates stolen credentials server-side to hinder analysis; found via HuntSQL crawler data, plus a healthcare-themed page.
blog · hunt.io
Russian-Speaking Threat Actor Abuses Cloudflare & Telegram in Phishing Campaign
The Russian-speaking actor behind earlier EFF impersonation now runs Cloudflare-branded DMCA phishing with LNK files, Telegram-bot victim filtering, and Pyramid C2; an open directory exposed it.
blog · hunt.io
GreenSpot APT Targets NetEase 163.com Users with Fake Download Pages & Spoofed Domains
GreenSpot-linked infrastructure spoofs NetEase 163.com with a malicious login page and fake download pages on domains registered hours apart via a reseller, to steal credentials.
blog · hunt.io
Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
back