InfoSecBulletin Cybersecurity for mankind
Security researchers recently identified a phishing campaign targeting Microsoft 365 users that takes advantage of CloudFlare’s anti-bot and verification systems. Attackers employ various anti-detection techniques to ensure only genuine victims access the credential-stealing sites.
CloudFlare Used as a Protective Shield
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
The campaign begins with a phishing domain hosted behind CloudFlare infrastructure.
Example domain observed in the campaign:
securedsnmail[.]com.
https[:]//securedsnmail[.]com/secdex.html.
When users visit the site, they see a CloudFlare human verification page first. This prevents automated tools from analyzing malicious content.
The attackers used various methods to hide the phishing site from security systems.
These include:
CloudFlare uses human verification to block automated scanning tools.
IP filtering using data from api.ipify[.]org to identify the visitor’s IP address.
Hardcoded blocklists that exclude IP ranges belonging to security companies such as Palo Alto Networks, FireEye, AWS, and Google Cloud platforms.
User‑agent inspection to detect bots and crawlers such as Googlebot, Bingbot, AhrefsBot, and Twitterbot.
When a security scanner or bot is detected, the site shows a fake “404 Not Found” page. This stops the domain from being indexed by search engines or flagged by security tools.
Infrastructure Patterns
Several shared infrastructure indicators were observed across the campaign:
Nameservers: cloudflare.com.
Registrar: Namecheap.
MX hosts: registrar-servers[.]com, jellyfish[.]systems.
Hosting ISP: CloudFlare Inc.
These similarities indicate a planned phishing setup that allows for the rapid creation of new domains when the old ones are found. This campaign addresses a rising issue in cybersecurity. Attackers are using legitimate security platforms intended to protect websites as cover.
Security researchers suggest that improved customer verification and abuse monitoring by service providers can help reduce phishing and credential theft on their platforms.
IOCs
| securedreach[.]com | wirelessmailsent[.]com |
| suitecorporate[.]com | suitetosecured[.]com |
