How phishers hide banking scams behind free Cloudflare Pages

A Malwarebytes investigation reveals that phishers are hiding banking scams on free hosting platforms by pairing Cloudflare Pages with compromised legitimate websites to create convincing portals for banking and insurance logins. The kit not only captures usernames and passwords but also prompts for security questions and other data that can bypass multi-factor authentication and account recovery protections.

Instead of sending data to a traditional server, submissions are forwarded to a Telegram bot, giving attackers a live feed of fresh logins and sidestepping many domain-based blocks. The campaign frequently uses subdomains on *.pages[.]dev to impersonate financial and healthcare providers, with one early example resembling Heartland bank Arvest and another impersonating United Healthcare, while attackers also redirect via compromised domains like biancalentinidesigns[.]com to reach the Cloudflare Pages site.

The exfiltration mechanism posts credentials and answers to one or more Telegram chats using hardcoded bot tokens and chat IDs, enabling rapid redeployment and evading some security controls.