InfoSecBulletin Cybersecurity for mankind
Security researchers recently identified a phishing campaign targeting Microsoft 365 users that takes advantage of CloudFlare’s anti-bot and verification systems. Attackers employ various anti-detection techniques to ensure only genuine victims access the credential-stealing sites.
CloudFlare Used as a Protective Shield
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
The campaign begins with a phishing domain hosted behind CloudFlare infrastructure.
Example domain observed in the campaign:
securedsnmail[.]com.
https[:]//securedsnmail[.]com/secdex.html.
When users visit the site, they see a CloudFlare human verification page first. This prevents automated tools from analyzing malicious content.
The attackers used various methods to hide the phishing site from security systems.
These include:
CloudFlare uses human verification to block automated scanning tools.
IP filtering using data from api.ipify[.]org to identify the visitor’s IP address.
Hardcoded blocklists that exclude IP ranges belonging to security companies such as Palo Alto Networks, FireEye, AWS, and Google Cloud platforms.
User‑agent inspection to detect bots and crawlers such as Googlebot, Bingbot, AhrefsBot, and Twitterbot.
When a security scanner or bot is detected, the site shows a fake “404 Not Found” page. This stops the domain from being indexed by search engines or flagged by security tools.
Infrastructure Patterns
Several shared infrastructure indicators were observed across the campaign:
Nameservers: cloudflare.com.
Registrar: Namecheap.
MX hosts: registrar-servers[.]com, jellyfish[.]systems.
Hosting ISP: CloudFlare Inc.
These similarities indicate a planned phishing setup that allows for the rapid creation of new domains when the old ones are found. This campaign addresses a rising issue in cybersecurity. Attackers are using legitimate security platforms intended to protect websites as cover.
Security researchers suggest that improved customer verification and abuse monitoring by service providers can help reduce phishing and credential theft on their platforms.
IOCs
| securedreach[.]com | wirelessmailsent[.]com |
| suitecorporate[.]com | suitetosecured[.]com |
