Hackers Use Cloudflare Human Check to Hide Microsoft 365 Phishing Pages

Scammers are hijacking popular security tools like Cloudflare to hide fake Microsoft 365 login pages. Learn how this new invisible phishing campaign bypasses antivirus software and how you can stay safe.

Most of us have clicked the familiar “prove you are human” box from Cloudflare while browsing the web. Now attackers are using that same security feature as cover for a new type of cyberattack.

According to a new report from the research firm DomainTools, scammers are now hijacking Cloudflare’s security tools to hide fake Microsoft 365 login pages from the very experts trying to shut them down.

The trick is as simple as it is effective. When a victim clicks a link to a malicious site, such as securedsnmail.com in this case, they hit a ‘Turnstile’ verification check. This, as we know it, is meant to stop bots, but here it acts as a filter to keep ...