- What: Cloudflare Pages is being abused to host SEO blog content that redirects users to phishing pages, adware installers, and fake browser downloads.
- Impact: Users are at risk of being tricked into installing malware or providing credentials to phishing sites.
I recently investigated a campaign abusing Cloudflare Pages (pages[.]dev) to host benign looking SEO blog content that displays a delayed "Continue Read" modal. The click gated interaction redirects users into a shared backend redirector, which conditionally routes traffic to phishing pages, adware/PUP installers, fake browser download lures, and QR based social engineering flows. submitted by /u/anuraggawande [link] [comments]