Exposing Massive Phishing Scams Abusing Cloudflare Services

A Hunt research post exposes a mass phishing campaign (over 60,000 discovered URLs) that leverages Cloudflare Workers and IPFS Gateways plus a shared Font Awesome kit to host convincing fake login pages for Office365/SharePoint, Adobe, and other services. The report walks through example pages and JavaScript that validate and exfiltrate credentials to actor-controlled PHP endpoints, highlights reuse of a Font Awesome kit as an identifying artifact, and summarizes the abuse of decentralized and serverless hosting to complicate takedown efforts.