Tracked topic
Cloudflare is a web infrastructure and security company that provides services such as content delivery, DNS, and DDoS protection.
… Users visiting these websites are shown a fake Cloudflare verification or CAPTCHA prompt that instructs them to copy and manually execute a malicious PowerShell command on their system, which leads to a Vidar Stealer infection. “The Australian Signals Directorate’s Australian Cyber Security Center … …
… Visitors passing the verification are served a fake Cloudflare prompt loaded via an iframe on top of the article page, which contains the ClickFix lure. …
… According to the researchers, the attack uses an invoice-themed phishing email containing a Trustifi tracking URL that redirects through Trustifi, Cloudflare Workers, and several obfuscated JavaScript layers, landing the victim on a fake Microsoft CAPTCHA page. …