Cloudflare-Fronted Phishing and Malware Networks Exposed Through Shared Origin Infrastructure

Researchers uncovered two large-scale malicious infrastructures that used Cloudflare-fronted domains and wildcard subdomains to hide centralized backend systems. In one campaign, investigators traced an adversary-in-the-middle (AiTM) phishing operation from four suspicious domains to at least seven domains and more than 200 subdomains impersonating enterprise VPN and SSO portals, including Palo Alto GlobalProtect, Fortinet FortiGate, Cisco AnyConnect, Citrix, and Microsoft OWA. The phishing flow presented fake Cloudflare challenge pages before credential prompts, and the infrastructure was linked to a single origin server at 178.16.53.131 in Germany. Researchers said the platform could relay live authentication sessions and steal both credentials and session tokens, allowing attackers to bypass traditional MFA protections.

A separate investigation tied a single ClearFake indicator to a broader malware delivery network spanning 24 .in.net domains, more than 100 subdomains, two Cloudflare account clusters, and a shared WebDAV origin server. Analysts found wildcard DNS and TLS certificates across the domains, identical ETag values indicating common hosting, and an exposed payload inventory accessible through unauthenticated WebDAV requests. The campaign used compromised websites to redirect victims to fake verification pages and then delivered malicious DLLs and two newly identified obfuscated Go binaries disguised as Logitech and Intel components. Breakglass reported that the recovered payloads had zero detections in VirusTotal and MalwareBazaar at the time of discovery, while multiple OPSEC mistakes—including leaked headers, an exposed staging directory, and a recurring "werification" typo—helped map the operation.