Hackers Exploit CloudFlare Anti-Security to Steal Microsoft 365 Login Credentials

A recent campaign targeting Microsoft 365 credentials demonstrates the exploitation of CloudFlare's protective features by attackers to shield malicious phishing sites from security scanners and threat researchers.

CloudFlare Used as a Protective Shield

CloudFlare, commonly used to enhance website performance and protect against threats such as bots and DDoS attacks, can also be leveraged by malicious actors to conceal phishing pages. In this campaign, attackers use CloudFlare's anti-bot and verification systems to ensure that only actual victims access the credential-stealing pages.

The campaign commences with a phishing domain hosted behind CloudFlare's infrastructure. An example domain observed is:

securedsnmail[.]com https[:]//securedsnmail[.]com/secdex.html

Visitors to the site are first met with a CloudFlare human verification page, blocking automated scanners and security tools from examining the malicious content. Once verification is complete, victims are redirected to the next stage of the attack, which employs multiple gatekeeping techniques to prevent detection, including:

CloudFlare's human verification to block automated scanning tools IP filtering using data from api.ipify[.]org Hardcoded blocklists excluding IP ranges from security companies User-agent inspection to detect bots and crawlers

If a security scanner or bot is detected, a fake "404 Not Found" page is displayed, preventing indexing by search engines or flagging by security tools.

The credential theft logic is heavily obfuscated, using a custom virtual machine function to execute encoded instructions, complicating the detection of data exfiltration or command-and-control infrastructure. If all gatekeeping checks are passed, a phishing redirect URL is generated, such as:

https[:]//office.suitetosecured[.]com/KuPbXodA?b=cGjQKg4&auth={}

The generated auth parameter tracks the victim’s successful verification before reaching the Microsoft 365 credential harvesting page. Researchers identified a common CloudFlare Turnstile configuration across multiple phishing domains, using a static Turnstile sitekey:

This identifier corresponds to a specific CloudFlare account configuration. Security teams can use this key to search platforms like Shodan and URLScan to find additional phishing domains linked to the same infrastructure.

Shared infrastructure indicators observed in the campaign include:

Nameservers: cloudflare.com Registrar: Namecheap MX hosts: registrar-servers[.]com, jellyfish[.]systems Hosting ISP: CloudFlare Inc.

These commonalities suggest a coordinated phishing framework designed for rapid deployment of new domains upon detection of older ones.

The campaign illustrates the challenge in cybersecurity where attackers exploit legitimate security and content delivery platforms to delay detection of malicious activities. Enhanced customer verification and abuse monitoring by service providers may help mitigate the misuse of these platforms for phishing and credential harvesting operations.

securedreach[.]com wirelessmailsent[.]com

suitecorporate[.]com suitetosecured[.]com

Based on reporting by GBHackers.