'SloppyLemming' APT Abuses Cloudflare Service in Pakistan Attacks

SloppyLemming, an APT linked to India, is conducting a multi-stage espionage campaign across South Asia that begins with spear-phishing and abuses cloud services (notably Cloudflare Workers) to host phishing pages (via a tool called CloudPhish), harvest credentials (exfiltrated to Discord), and deliver a RAT — including chains that exploit CVE-2023-38831 in WinRAR — against government, law enforcement, energy, and critical infrastructure targets.