How phishers hide banking scams behind free Cloudflare Pages

This report details a phishing campaign that leverages compromised legitimate sites as redirectors to Cloudflare Pages (*.pages.dev) phishing pages replicating banking and health provider logins; the kit harvests credentials, security-question answers, and device metadata and forwards submissions to Telegram bots for real-time exfiltration and rapid infrastructure rotation.