Sophisticated Phishing Campaign Abuses Webflow CDN to Steal Credit Card Data

Netskope Threat Labs describes an active phishing campaign (since late 2024) that uses SEO to surface malicious PDFs hosted on Webflow; embedded fake CAPTCHA images redirect victims to Cloudflare Turnstile and a fake forum signup flow that collects emails, names, and credit card information, impacting thousands of users across hundreds of organizations.