🧰 Cloudflare Workers

The items that name it 28

• In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
  articleas classification.technologies2026-10-30
• The Current Landscape of OAuth Attacks
  articleas affected products2026-10-22It is written here as Cloudflare Workers (used to deliver obfuscated phishing payloads).

  used to deliver obfuscated phishing payloads

• Localizing compliance at scale: achieving South Korea’s ISMS certification
  articleas affected products2026-10-22It is written here as Cloudflare Workers (request.cf.country).

  request.cf.country

• A fully programmable secure web gateway
  articleas tools2026-10-15

  Edge compute platform used to run customer code inline in Gateway policy evaluation, as proxy middleware or as custom selectors and DLP validators.

• 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials
  writeupas tools2026-10-07

  Used by attackers as exfiltration/C2 endpoints (e.g. icy-star-f45c.workers.dev, fondationanimalaidrelief.workers.dev) receiving stolen wallet secrets

• Sandboxes Explained: What Each Type Actually Isolates | Blog | Endor Labs
  articleas affected products2026-10-02

  Runs thousands of tenants per process using V8 isolates.

• Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
  writeupas classification.technologies2026-09-30
• [tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
  articleas tools2026-09-17

  Platform on which Cloudflare's spec reviewer runs, storing results and state in D1

• CassiopeiaCode/CosyRedactGateway
  repoas classification.technologies2026-09-11
• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
  writeupas classification.technologies2026-09-09
• ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
  writeupas classification.technologies2026-09-08
• Socket: "Superior" Campaign
  writeupas tools2026-08-28

  Used by threat actor as data exfiltration sinks (pipi.saghirmohamed19.workers.dev, mimi.saghirmohamed19.workers.dev)

• Cloudflare Computer
  repoas classification.technologies2026-08-25
• Socket: "Offside Wallet Theft Factory"
  writeupas tools2026-08-19

  Legitimate serverless platform abused as exfiltration endpoints for stolen recovery phrases, private keys, credentials and clipboard data

• Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
  writeupas classification.technologies2026-08-06
• TRONSEC
  repoas classification.technologies2026-08-05
• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeupas classification.technologies2026-07-15
• Thinkst Package Proxy
  toolas tools2026-06-26

  Platform on which Package Proxy is built and deployed

• We Need to Talk About Device Code Phishing
  articleas tools2026-06-22

  Used as part of multi-hop redirect chains in phishing lures to obscure the attack path.

• Teycir/SkillsGuard
  repoas classification.technologies2026-06-21
• Inside Kali365, a Device Code Phishing Ecosystem | Huntress
  writeupas tools2026-06-11

  Used by the phishing kit to route lure traffic through linked custom domains (CF-Worker linking pipeline)

• Social Engineering Leveled Up. Has Your Security Program?
  articleas classification.technologies2026-05-01
• Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
  writeupas classification.technologies2026-03-23
• A Threat Actor Abuses Another Free Trial
  writeupas tools2026-03-06

  Used to host Velociraptor callback infrastructure, with subdomains (e.g. qgtxtebl.workers.dev) matching disposable email prefixes

• Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)
  writeupas classification.technologies2026-02-08
• Velociraptor Misuse, Pt. II: The Eye of the Storm
  writeupas classification.technologies2025-12-03
• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
  articleas classification.technologies
• Lonkero — Rust web vulnerability scanner (v3.7, AI agent mode)
  repoas affected products

  Fixed static/SPA skip logic so these are properly tested as dynamic

In every workspace you can read 34