Error 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error Pages

Group-IB researchers expose a large-scale smishing and phishing operation impersonating 260+ brands across 72 countries, using fake Cloudflare error pages, geofencing, and encrypted WebSocket channels for real-time credit card theft. The operation has a layered anti-analysis evasion architecture, which uses Read More …

Analyzing a Multi-Stage AsyncRAT Campaign via Managed Detection and Response

AsyncRAT has emerged as a notable Remote Access Trojan (RAT) used by threat actors for its robust capabilities and ease of deployment. It gained favor for its extensive feature set, which includes keylogging, screen capturing, and remote command execution capabilities. Read More …

How phishers hide banking scams behind free Cloudflare Pages

During a recent investigation, we uncovered a phishing operation that combines free hosting on developer platforms with compromised legitimate websites to build convincing banking and insurance login portals. These fake pages don’t just grab a username and password–they also ask Read More …

Cloudflare says service restored after outage that brought down sites including Zoom and LinkedIn

Internet infrastructure company Cloudflare on Friday said it had restored services following an outage that took place in the morning and brought down several global websites including LinkedIn, Zoom and others, the second such crash to affect the company in Read More …

Cloudflare outage impacts thousands, disrupts transit systems, ChatGPT, X and more

A widely used Internet infrastructure company said that it has resolved an issue that led to outages impacting users of everything from ChatGPT and the online game, “League of Legends,” to the New Jersey Transit system early Tuesday. Around 10 Read More …