Cloudflare Domains Exploited: A 250% Surge in Cyber Threats

Cloudflare’s developer platforms, including pages.dev and workers.dev, are increasingly exploited by cybercriminals for phishing and other malicious activities. These domains, designed to streamline website deployment and serverless computing, have become an attractive tool for threat actors. According to a report by cybersecurity firm Fortra, abuse of these domains has surged between 100% and 250% compared to 2023, posing significant challenges for detection and mitigation.

This article explores the tactics employed by threat actors, the specific ways Cloudflare’s services are misused, and actionable steps to bolster defenses against such attacks.

Leveraging Trusted Infrastructure for Malicious Intent

The growing misuse of Cloudflare domains stems from their inherent advantages:

1. Trusted Reputation: Cloudflare’s established brand and robust security framework make malicious URLs hosted on its domains appear legitimate.
2. Cost-Effectiveness: The low operational costs of these platforms appeal to threat actors seeking scalability without significant expense.
3. Reverse Proxying Features: This capability complicates detection and obscures the attack origin, enabling evasion of traditional security measures.

Cloudflare Pages: Abuse in Phishing Campaigns

Cloudflare Pages is designed to enable developers to create, deploy, and host secure, high-performance websites. With features like default SSL/TLS encryption and support for modern web frameworks, the platform ensures scalability and security. However, cybercriminals have repurposed its advantages.

Phishing Tactics Using Cloudflare Pages

Fortra’s analysis reveals that attackers use Cloudflare Pages to host intermediary phishing sites. These pages often redirect victims to fraudulent platforms like fake Microsoft Office 365 login portals.

• How the Attack Works:
  Victims are lured via phishing emails or malicious PDFs containing embedded links. Due to Cloudflare’s positive reputation, these links evade detection by many security solutions.

• Statistics Highlighting the Threat:

  • 198% Increase: Phishing attacks on Cloudflare Pages rose from 460 incidents in 2023 to 1,370 as of October 2024.
  • Projected Growth: Fortra estimates a total of 1,600 incidents by year-end, marking a 257% year-over-year increase.

Concealing Scale Through BccFoldering

Attackers further amplify their campaigns using the bccfoldering tactic, which obscures recipient visibility. By adding recipients to the email envelope instead of headers, attackers make it difficult to detect the campaign’s full scope.

Cloudflare Workers: A Multifaceted Attack Vector

Cloudflare Workers, a serverless computing platform, allows developers to deploy lightweight scripts and applications on Cloudflare’s edge network. While designed for legitimate uses like API deployments and content optimization, the platform has seen a sharp rise in abuse.

Exploitation Methods

Cybercriminals use Cloudflare Workers for:

• Phishing: Hosting verification steps to lend credibility to scams.
• DDoS Attacks: Leveraging the platform’s distributed nature to launch overwhelming traffic against targets.
• Malware Injection: Deploying harmful scripts onto victims’ browsers.
• Credential Attacks: Brute-forcing account passwords.

Notable Case: Phishing Verification Pages

One campaign highlighted by Fortra used Cloudflare Workers to host a “human verification step” in a phishing scheme, further enhancing the illusion of legitimacy.

• Key Metrics:
  • 104% Increase: Phishing incidents rose from 2,447 in 2023 to 4,999 in 2024.
  • Expected Surge: With an average of 499 incidents per month, the total volume could reach nearly 6,000 incidents by the end of the year, representing a 145% year-over-year increase.