Serpentine#Cloud Uses Cloudflare Tunnels in Sneak Attacks

Securonix researchers describe an active, sophisticated campaign called "Serpentine#Cloud" in which phished .lnk shortcut files fetch obfuscated batch scripts that deploy decoy documents, check antivirus, and ultimately load Python-based in-memory shellcode hosted via Cloudflare's trycloudflare.com tunnels, resulting in backdoored systems across multiple countries; attribution is currently unknown and defenders are advised to focus on endpoint detection and phishing hygiene.