*.workers.dev

Phishing Download Exfiltration C&C

Cloudflare Workers can be used to host phishing websites.

Cloudflare Workers can be used as C&C servers.

Attackers can add upload functionalities hosted on *.workers.dev and exfiltrate data on there.

Malicious tools can be stored on *.workers.dev and downloaded when required.

https://www.joesandbox.com/analysis/506551/0/html