New Phishing Attack Exploits Cloudflare R2 Hosting Service to Steal Cloud Passwords
The Cloudflare R2 hosting service like the following platforms, which provides a cost-effective large-scale data storage platform to developers with no exit bandwidth charges:-
- Amazon S3
- Google GCS
- Azure Blob Storage
The cybersecurity analysts at Netskope Threat Labs recently noted a shocking 61-fold surge in traffic to Cloudflare R2-hosted phishing pages from February to July 2023.
Mostly focused on Microsoft credentials, these phishing campaigns also encompass other cloud apps like:-
- Adobe
- Dropbox
However, the prime targets of these phishing campaigns are primarily from North America and Asia across various sectors and industries like:-
- Technology
- Financial services
- Banking sectors
Phishing pages
For the distribution of the phishing pages, threat actors behind these phishing campaigns exploit Cloudflare R2’s free hosting service. While apart from this, with the help of two exceptional techniques, the operators evade the scanners and URL analyzers.
To prevent unwanted access and protect the pages, they implement a CAPTCHA with the help of Cloudflare Turnstile.
Additionally, malicious content loads only when supported by another harmful source, targeting specific victims.
It’s been urged that users must look out for URLs with the following pattern since threat actors take advantage of Clouflare’s free subdomain:-
https[:]//pub-<32_alphanumeric_string>.r2.dev/webpage[.]htm
Phishing Page With Cloudflare R2
In addition to abusing the Cloudflare Turnstile, some phishing sites delay the presentation of the page until meeting specific criteria. A timestamp after a hash in the referring site’s URL unveils the page while lacking a parameter redirects to “google.com.”
So, this dual action hides the malicious intent of the threat actor, safeguarding against scanners and enabling them to target the victims precisely.
For the real phishing page, a timestamp from the referrer is a must, as direct access shows a custom error message.
To identify the bot-crawled phishing pages, the phishing site deploys an open-source bot detection library, “Fingerprint BotD.” Upon detection of the bot on the page, the following custom error message is sent:-
- ERROR CODE 102 or 99
