Loading story…
Threat actors are abusing Cloudflare’s free hosting and tunneling services to make malicious infrastructure appear legitimate and evade filtering. Trend Micro reported an AsyncRAT campaign that uses TryCloudflare tunnel domains to stand up attacker-controlled WebDAV servers, effectively masking command-and-control and payload staging behind Cloudflare-trusted traffic. The infection chain starts with phishing emails containing Dropbox links to invoice-themed ZIP archives; the ZIPs include a deceptive double-extension Internet Shortcut (.url) that points to the WebDAV resource and triggers a multi-stage execution flow while opening a legitimate PDF as a decoy. The campaign also downloads legitimate Python components from official sources to establish a local Python environment used in later stages.
Separately, a long-lived fake “Fast Ray VPN” review site hosted on Cloudflare Pages (fast-ray-vpn.pages.dev) was observed redirecting users via tracking-heavy URLs to third-party domains associated with affiliate/traffic-broker style distribution. The “Download” links did not deliver a VPN client; instead, users were funneled to generic “Your File Download Is Ready!” pages and, in at least one observed path, were ultimately served OperaSetup.exe—legitimate software delivered through deceptive pretext, consistent with PUA/misleading distribution tactics rather than a conventional short-lived phishing page.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Forcepoint reported that the phishing campaign abusing Dropbox and TryCloudflare did not only deploy AsyncRAT, but also injected VenomRAT into notepad.exe and XWorm into another legitimate process. The analysis also described the Python loader's use of ctypes and Early Bird APC Queue injection alongside a fake PDF invoice decoy.
Trend Micro reported that attackers were abusing Cloudflare's free-tier TryCloudflare service to hide malicious WebDAV servers and command-and-control activity behind trusted Cloudflare traffic. The report highlighted the broader security risk of threat actors using legitimate cloud tunneling and hosting services to evade reputation-based defenses.
In the AsyncRAT campaign, victims were directed to download a legitimate signed Python installer from python.org, after which a script named ne.py injected AsyncRAT into explorer.exe. The attackers also established persistence by placing batch files such as ahke.bat and olsm.bat in the Startup folder.
Threat actors launched a campaign delivering AsyncRAT through phishing emails with Dropbox-hosted ZIP files disguised as invoices. The infection chain used a double-extension .url file to access a malicious WebDAV resource exposed through TryCloudflare tunnels and Cloudflare-backed infrastructure.
The fake Fast Ray VPN infrastructure was found to block further redirection when accessed from VPNs or sandbox-like environments, displaying an "Anonymous Proxy detected" message instead. This indicated anti-analysis controls designed to hinder investigation and automated inspection.
Researchers documented that the fake Fast Ray VPN site redirected users through tracking-laden third-party domains consistent with traffic-broker or affiliate infrastructure. Depending on conditions, visitors received unrelated software such as OperaSetup.exe, a potentially unwanted application identified as Pixelsee, or were sent to advertising, adult, or financial landing pages.
A deceptive site hosted at fast-ray-vpn.pages.dev was publicly accessible for at least eight months before reporting, posing as a legitimate Fast Ray VPN review page. It appeared in top Google results for "fast ray vpn," increasing the chance of organic user visits.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcemalwr-analysis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **phishing-led malware delivery** that abuses trusted services and “living off the land” execution paths to evade controls and deploy remote access tooling. Cloudflare-tracked activity shows attackers using **Vercel-hosted** pages to lend legitimacy to malicious links and bypass email/security filtering, with lures themed around invoices, payments, shipping, and document portals; the infrastructure includes **Telegram-based filtering** and browser fingerprinting/conditional delivery to hinder researchers and sandboxes before serving payloads that install a **remote access tool (RAT)**. A separate campaign (tracked as **PHALT#BLYX**) targets hospitality staff with Booking[.]com-style reservation emails and uses a **fake browser error + fake BSOD** to coerce victims into running the **ClickFix** technique (Win+R paste/execute), launching PowerShell that pulls malicious project files and executes them via **`MSBuild.exe`** to deliver **DCRat**, consistent with **LOLBins**-based evasion; researchers noted Russian-language artifacts in the malware. Broader weekly/newsletter roundups also highlight the same risk theme—attackers increasingly blend social engineering with trusted infrastructure and tools—while mixing in unrelated items (e.g., firewall CVEs, general malware research links) that are not part of a single, specific incident narrative.
Jun 29, 2026
Threat actors are using **software impersonation** and **SEO poisoning** to push victims toward fake download sites for trusted enterprise and IT tools, then delivering malware through trojanized installers. In one campaign, **Storm-2561** used spoofed VPN vendor pages for products such as **Pulse Secure, Fortinet, and Ivanti** to steal enterprise VPN credentials. The malicious packages were hosted on GitHub, signed with a certificate issued to **"Taiyuan Lihua Near Information Technology Co., Ltd."**, and designed to show an error before redirecting victims to the legitimate vendor site, reducing suspicion while exfiltrating credentials. A separate but closely related campaign used fake **FileZilla** download pages to distribute a **Remote Access Trojan** through multi-stage loaders and **DLL sideloading**. Attackers bundled legitimate FileZilla software with a malicious `version.dll`, or dropped the DLL during installation so the malware would execute while the expected application appeared to install normally. Both reports describe the same broader intrusion pattern: adversaries abusing trusted brands, realistic lookalike websites, and legitimate software packaging to compromise users who believe they are downloading authentic tools. A separate **Warlock** intrusion analysis describing web shells, lateral movement, tunneling, and ransomware activity is a different incident and does not match this malware-delivery story.
Jun 29, 2026
Breakglass Intelligence reported multiple active malware operations abusing **Cloudflare infrastructure**, WebDAV shares, and legitimate **Python** runtimes to deliver remote-access trojans and stealers through multi-stage infection chains. In the **SERPENTINE#CLOUD** activity, attackers used invoice-themed lures aimed primarily at German-speaking businesses, including spoofed DATEV documents delivered via `trycloudflare.com` tunnels exposing WsgiDAV servers. Victims were led through LNK, WSH, WSF, BAT, and URL shortcut stages before portable Python environments, shellcode loaders, and process injection into `explorer.exe` launched malware including **AsyncRAT, XWorm, DcRat, VenomRAT, Violet v5, PureHVNC, PureCrypter**, and the custom **PhilliVio** RAT. Researchers tied the campaign to at least 27 Cloudflare tunnel domains, persistent C2 infrastructure across multiple countries, and repeated operator OPSEC failures such as leaked builder hostnames and reusable metadata.
Jun 29, 2026