A new cybercrime operation dubbed SERPENTINE#CLOUD is leveraging Cloudflare Tunnel subdomains to distribute malicious payloads through sophisticated phishing attacks, according to security researchers at Securonix.
## How the Attack Works
The campaign begins with deceptive phishing emails featuring payment or invoice themes. These messages contain links to compressed files that house Windows shortcut (LNK) files disguised as legitimate documents. When victims open these shortcuts, they trigger a complex multi-stage infection process.
The attack chain utilizes Python-based shellcode loaders that execute payloads entirely in computer memory using the open-source Donut loader. This memory-only execution makes detection significantly more challenging for traditional security tools.
## Global Reach and Targets
The campaign has targeted users across multiple regions, including the United States, United Kingdom, Germany, and various countries throughout Europe and Asia. While the identity of the threat actors remains unknown, researchers note their proficiency in English.
## Evolution of Attack Methods
Security experts have observed the campaign shifting its initial access techniques, moving from internet shortcut (URL) files to LNK shortcut files that masquerade as PDF documents. These payloads retrieve additional attack stages through WebDAV connections via Cloudflare Tunnel subdomains.
Previous variations of this campaign, documented by eSentire and Proofpoint, deployed various malware types including AsyncRAT, GuLoader, PureLogs Stealer, Remcos RAT, Venom RAT, and XWorm.
## Why Cloudflare Infrastructure is Attractive to Attackers
Cybercriminals favor legitimate cloud service providers like Cloudflare for several reasons:
– **Reputation Shield**: Using trusted subdomains makes malicious activity harder to distinguish from legitimate traffic
– **Evasion Capabilities**: Bypasses URL and domain-based security blocking mechanisms
– **Encrypted Transport**: Provides secure, disposable infrastructure without maintaining traditional command-and-control servers
## Technical Attack Process
1. **Initial Infection**: LNK files download Windows Script Files (WSF) from remote WebDAV shares
2. **Script Execution**: WSF files run using cscript.exe without raising user suspicion
3. **Payload Delivery**: Batch scripts display decoy PDF documents while downloading Python payloads
4. **Final Stage**: Python loaders execute Donut-packed malware like AsyncRAT or Revenge RAT in memory
## Related Threats: Shadow Vector Campaign
Separately, Acronis researchers identified the Shadow Vector campaign targeting Colombian users through scalable vector graphics (SVG) files in phishing emails impersonating court notifications. This campaign deploys similar remote access trojans using SVG smuggling techniques and file-sharing services like Bitbucket, Dropbox, and Discord.
## The Rise of ClickFix Attacks
Security firm ReliaQuest reports a surge in ClickFix social engineering tactics, which trick users into performing seemingly harmless actions like completing CAPTCHA verifications. These attacks accounted for 23% of all phishing-based tactics between March and May 2025, demonstrating how cybercriminals increasingly exploit user behavior rather than technical vulnerabilities.
## Defense Implications
The SERPENTINE#CLOUD campaign represents a sophisticated blend of social engineering, legitimate infrastructure abuse, and memory-resident execution techniques. Its use of Cloudflare Tunnel infrastructure complicates network visibility and detection, highlighting the need for advanced behavioral analysis and user education in cybersecurity defense strategies.