Back to Intelligence

Multi-Stage Phishing Redirection Chains: Framer & Cloudflare Workers Abuse with HTML Smuggling — OTX Pulse Detection Pack

SA
Security Arsenal Team
August 13, 2026
11 min read

Classification: TLP:WHITE | Intelligence Type: Phishing Infrastructure / Initial Access | Urgency: HIGH

Threat Summary

A recent OTX pulse from AlienVault (LevelBlue SpiderLabs research) documents a sophisticated, actively evolving phishing ecosystem built on multi-stage redirection chains that deliberately abuse legitimate, trusted cloud infrastructure to evade both email gateways and web proxies. The campaigns chain together:

  1. Framer — a legitimate no-code website builder — abused to host convincing, professionally designed phishing landing pages that inherit the platform's trusted reputation and TLS certificates.
  2. Cloudflare Workers — serverless edge functions used as redirect relays and content-proxies, making malicious traffic appear to originate from Cloudflare's globally trusted IP space.
  3. Newly registered domains (NRDs) — algorithmic-looking throwaway domains (e.g., 2934523t5234535323973294afhdsfga.com, bl.dase7.shop) used as disposable final-stage hops.
  4. HTML redirection smuggling via the Blob API — the final phishing payload is assembled client-side in the browser using Blob objects and decrypted with the Web Crypto API, meaning the malicious HTML never traverses the network as a scannable file. Network-based inspection sees only benign-looking JavaScript.

The observed objective is credential harvesting and brand impersonation (DocuSign-themed lure paths are visible in the indicators, e.g., /frontdeskformationdocusignpaywet/), with tags also indicating device code phishing — an OAuth abuse technique that tricks victims into authorizing attacker-controlled devices against legitimate identity providers (commonly Microsoft Entra ID), yielding persistent token access without ever stealing a password. This dual-lure approach (classic credential pages + device code flows) signals an operator focused on enterprise identity compromise, the precursor to BEC, MFA fatigue campaigns, and cloud tenant takeover.

The infrastructure pattern — legitimate PaaS front-end + Workers relay + NRD terminus — is architected specifically to defeat reputation filtering: every early hop in the chain is a high-reputation service, and the malicious terminus domains burn and rotate within hours.

Threat Actor / Malware Profile

Attribution: Unknown actor; no named APT or malware family is attached to this pulse. This is a phishing-as-infrastructure operation rather than a traditional malware campaign — the "payload" is the phishing page itself plus token/credential capture.

Distribution method: Phishing emails and lures containing links that initiate a multi-hop redirection chain (Framer-hosted page → Cloudflare Worker relay → NRD-hosted final stage). One indicator shows a doubled .html.html extension and an obscene URL path length — a hallmark of dynamically generated, single-use lure URLs designed to break URL extraction in sandboxes and link scanners.

Payload behavior:

  • The final stage delivers an encrypted HTML blob embedded in JavaScript.
  • The Web Crypto API (crypto.subtle.decrypt) decrypts the payload in-browser.
  • The Blob API (URL.createObjectURL) materializes the decrypted HTML into a same-origin-looking object URL, which then renders the credential/brand-impersonation page.
  • Because decryption happens client-side, the "phishing kit" is never written to disk and never crosses the wire in plaintext — defeating file-based AV, email detonation, and most web content inspection.

C2 / exfiltration: Stolen credentials and device-code authorizations are typically POSTed to the same NRD terminus or a Workers endpoint, blending into normal HTTPS to Cloudflare IP space.

Persistence mechanism: No host persistence. Persistence is achieved at the identity layer via OAuth device code grants — attacker-authorized sessions/tokens survive password resets unless refresh tokens are revoked.

Anti-analysis techniques: Multi-stage redirection (each stage inert in isolation), trusted-infrastructure hosting, client-side decryption (no network-visible payload), randomized long URL paths, doubled file extensions, and rapid NRD rotation.

IOC Analysis

The pulse contains 7 indicators across 3 types — domains, hostnames, and full URLs:

IndicatorTypeRole in Chain
2934523t5234535323973294afhdsfga.comdomainNRD terminus — algorithmic name, classic burn-after-use pattern
alasilla.comdomainHosts DocuSign-themed lure path (/frontdeskformationdocusignpaywet/...) — likely compromised or abused mid-chain relay
bl.dase7.shophostnameSubdomain on cheap .shop TLD serving randomized .html.html smuggling page
4x URLsURLFull lure chains — extremely long randomized paths designed to evade URL-scanner extraction and per-URL blocklisting

No file hashes or IPs are present — consistent with a fileless, browser-assembled payload. Operationalization guidance:

  • Domains/hostnames → push to DNS sinkhole, web proxy block, and email gateway URL rewriting immediately. These have the longest detection shelf life.
  • Full URLs → low blocklist value (single-use, randomized paths) but high hunting value: regex on the path patterns (/[A-Za-z0-9]{30,}) across proxy logs catches the rotation family.
  • NRD heuristics → the domain 2934523t5234535323973294afhdsfga.com (long digit-string + keyboard-mash suffix) should seed a detection rule for similar entropy patterns in DNS telemetry.
  • Note one URL indicator contains a trailing smart-quote (html.html”) — sanitize indicators before ingestion to avoid malformed IOC entries in your TIP.

Detection Engineering

YAML
---
title: HTML Smuggling via Blob API and Web Crypto API in Browser
description: Detects browser processes loading scripts that combine Blob object URL creation with Web Crypto API decryption — the client-side payload assembly pattern used in multi-stage phishing redirection chains (Framer/Cloudflare Workers campaigns)
id: 9b3e1a42-7c5d-4e8f-a1b2-3c4d5e6f7a01
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
    category: dns
    product: windows
detection:
    selection_iocs:
        - '2934523t5234535323973294afhdsfga.com'
        - 'alasilla.com'
        - 'bl.dase7.shop'
        - 'dase7.shop'
    condition: selection_iocs
falsepositives:
    - Legitimate use of these domains is not expected; newly registered algorithmic domains have near-zero benign traffic
level: high
tags:
    - attack.initial_access
    - attack.t1566.002
date: 2026/08/14
---
title: Phishing Redirection Chain Terminus — Algorithmic NRD DNS Query
description: Detects DNS queries matching the high-entropy newly-registered-domain pattern observed in the phishing redirection chain terminus (long numeric strings concatenated with keyboard-mash character sequences)
id: 9b3e1a42-7c5d-4e8f-a1b2-3c4d5e6f7a02
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
    category: dns
detection:
    selection_numeric_entropy:
        query|re: '^[0-9]{10,}[a-z]{5,}\.(com|shop|top|xyz|click|site)$'
    filter_known:
        query|endswith:
            - '.corp.local'
            - '.internal'
    condition: selection_numeric_entropy and not filter_known
falsepositives:
    - Rare; some CDN edge hostnames use long numeric prefixes — tune per environment
level: medium
tags:
    - attack.initial_access
    - attack.t1071.001
date: 2026/08/14
---
title: OAuth Device Code Flow Initiation from Unmanaged Endpoint
description: Detects authentication attempts using the OAuth 2.0 device authorization grant (device code phishing) — observed lure technique in this campaign used to gain token persistence without password theft
id: 9b3e1a42-7c5d-4e8f-a1b2-3c4d5e6f7a03
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        authentication_protocol: 'deviceCode'
    selection_anomaly:
        risk_level: 'high'
    condition: selection or selection_anomaly
falsepositives:
    - Legitimate device code flows (Azure CLI, IoT device enrollment, some VPN clients) — baseline known device-registration sources first
level: high
tags:
    - attack.initial_access
    - attack.t1550
    - attack.t1528
date: 2026/08/14
KQL — Microsoft Sentinel / Defender
// Hunt: Multi-stage phishing redirection chain activity
// Combines IOC matching with behavioral patterns (NRD entropy, suspicious TLDs, long URL paths)
let PhishingIoCs = dynamic([
    "2934523t5234535323973294afhdsfga.com",
    "alasilla.com",
    "bl.dase7.shop",
    "dase7.shop"
]);
let HighRiskTLDs = dynamic([".shop", ".top", ".xyz", ".click", ".site", ".quest", ".bond"]);
union isfuzzy=true
    (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | extend RemoteHost = tostring(RemoteUrl)
    | where RemoteHost has_any (PhishingIoCs)
       or (RemoteHost endswith_any (HighRiskTLDs) and strlen(RemoteHost) > 25)
    | project HuntSource="NetworkEvent", TimeGenerated, DeviceName, InitiatingProcessAccountName,
              InitiatingProcessFileName, RemoteHost, RemoteIP, ActionType
    ),
    (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
    | where ProcessCommandLine has_any (PhishingIoCs)
       or ProcessCommandLine matches regex @"https?://[a-z0-9.\-]+/[A-Za-z0-9/]{60,}"
    | project HuntSource="BrowserLaunch", TimeGenerated, DeviceName, AccountName,
              FileName, ProcessCommandLine, InitiatingProcessFileName
    ),
    (
    EmailUrlInfo
    | where TimeGenerated > ago(7d)
    | where Url has_any (PhishingIoCs)
       or Url matches regex @"\.html\.html"
       or Url matches regex @"https?://[a-z0-9.\-]+/[A-Za-z0-9/]{60,}"
    | join kind=inner (EmailEvents | where TimeGenerated > ago(7d)) on NetworkMessageId
    | project HuntSource="EmailURL", TimeGenerated, SenderFromAddress, RecipientEmailAddress,
              Subject, Url, DeliveryAction
    )
| sort by TimeGenerated desc
PowerShell
# Security Arsenal — Multi-Stage Phishing Chain Endpoint Hunt
# Checks browser artifacts, DNS cache, and recent network connections for pulse IOCs
# Run elevated via EDR remote shell or SCCM across fleet

$ErrorActionPreference = 'SilentlyContinue'
$IoCs = @(
    '2934523t5234535323973294afhdsfga.com',
    'alasilla.com',
    'bl.dase7.shop',
    'dase7.shop'
)
$HighRiskTLD = '\.(shop|top|xyz|click|site|quest|bond)$'
$findings = @()

Write-Host "[*] === Phase 1: DNS Cache Inspection ===" -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache
foreach ($ioc in $IoCs) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$ioc*" }
    foreach ($h in $hits) {
        $findings += [PSCustomObject]@{
            Phase = 'DNS-Cache'; IOC = $ioc; Artifact = $h.Entry
            Data = $h.Data; Time = (Get-Date)
        }
        Write-Host "[HIT] DNS cache resolves: $($h.Entry) -> $($h.Data)" -ForegroundColor Red
    }
}
# Entropy check: long numeric-prefix algorithmic domains
$dnsCache | Where-Object { $_.Entry -match '^[0-9]{10,}[a-z]{5,}\.(com|shop|top|xyz)$' } |
    ForEach-Object {
        $findings += [PSCustomObject]@{ Phase='DNS-Entropy'; IOC='NRD-pattern'; Artifact=$_.Entry; Data=$_.Data; Time=(Get-Date) }
        Write-Host "[HIT] High-entropy NRD in cache: $($_.Entry)" -ForegroundColor Yellow
    }

Write-Host "[*] === Phase 2: Browser History Artifacts ===" -ForegroundColor Cyan
$users = Get-ChildItem 'C:\Users' -Directory | Where-Object { $_.Name -notin @('Public','Default') }
foreach ($u in $users) {
    $chromeHistory = "$($u.FullName)\AppData\Local\Google\Chrome\User Data\Default\History"
    $edgeHistory   = "$($u.FullName)\AppData\Local\Microsoft\Edge\User Data\Default\History"
    foreach ($hist in @($chromeHistory, $edgeHistory)) {
        if (Test-Path $hist) {
            $tmp = "$env:TEMP\hist_$(Get-Random).db"
            Copy-Item $hist $tmp -Force
            try {
                Add-Type -AssemblyName System.Data
                # Lightweight scan: raw byte pattern match (avoids SQLite dependency)
                $bytes = [System.IO.File]::ReadAllText($tmp, [System.Text.Encoding]::ASCII)
                foreach ($ioc in $IoCs) {
                    if ($bytes -match [regex]::Escape($ioc)) {
                        $findings += [PSCustomObject]@{
                            Phase='Browser-History'; IOC=$ioc; Artifact=$hist
                            Data="User: $($u.Name)"; Time=(Get-Date)
                        }
                        Write-Host "[HIT] Browser history contains IOC $ioc (user: $($u.Name))" -ForegroundColor Red
                    }
                }
            } finally { Remove-Item $tmp -Force }
        }
    }
}

Write-Host "[*] === Phase 3: Active/Historical Network Connections ===" -ForegroundColor Cyan
$conns = Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' }
foreach ($c in $conns) {
    $resolved = (Resolve-DnsName $c.RemoteAddress -ErrorAction SilentlyContinue).NameHost
    foreach ($ioc in $IoCs) {
        if ($resolved -like "*$ioc*") {
            $proc = Get-Process -Id $c.OwningProcess
            $findings += [PSCustomObject]@{
                Phase='Net-Connection'; IOC=$ioc; Artifact="$($c.LocalAddress):$($c.LocalPort) -> $($c.RemoteAddress):$($c.RemotePort)"
                Data="Process: $($proc.ProcessName) (PID $($c.OwningProcess))"; Time=(Get-Date)
            }
            Write-Host "[HIT] Active connection to $resolved by $($proc.ProcessName)" -ForegroundColor Red
        }
    }
}

Write-Host "[*] === Phase 4: Device Code Phishing — Token/Consent Artifacts ===" -ForegroundColor Cyan
# Check for recently modified WAM/TokenBroker cache (possible OAuth token capture target)
foreach ($u in $users) {
    $tbPath = "$($u.FullName)\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy"
    if (Test-Path $tbPath) {
        $recent = Get-ChildItem $tbPath -Recurse -File | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-3) }
        if ($recent) {
            Write-Host "[INFO] Recent TokenBroker activity for $($u.Name) — correlate with Entra sign-in logs for deviceCode auth" -ForegroundColor Yellow
            $findings += [PSCustomObject]@{ Phase='TokenBroker'; IOC='N/A'; Artifact=$tbPath; Data="User: $($u.Name), Files: $($recent.Count)"; Time=(Get-Date) }
        }
    }
}

Write-Host "`n[*] === Hunt Complete: $($findings.Count) findings ===" -ForegroundColor Cyan
$findings | Export-Csv -Path ".\phishing_chain_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
$findings | Format-Table -AutoSize

Response Priorities

Immediate (0–4 hours):

  • Block 2934523t5234535323973294afhdsfga.com, alasilla.com, bl.dase7.shop, and apex dase7.shop at DNS resolver, web proxy, and email gateway URL rewriting layers.
  • Deploy the high-entropy NRD regex (^[0-9]{10,}[a-z]{5,}\.(...)$) and the .html.html doubled-extension pattern as detections — these catch the rotation family, not just today's indicators.
  • Run the KQL hunt across the last 7 days; any host that reached the terminus domains is a presumed credential-compromise candidate.
  • Search email logs for messages containing these URLs, even if delivery was blocked — identify the targeted population.

24 hours:

  • This is credential and token theft — treat every clicker as compromised. Force password resets for any user whose browser history, DNS cache, or proxy logs show contact with the IOC set.
  • Critically: query Entra ID sign-in logs for deviceCode authentication protocol events from the targeted user population. Device code phishing grants refresh tokens that survive password resets — revoke all refresh tokens (Revoke-AzureADUserAllRefreshToken) for affected users, not just passwords.
  • Review OAuth app consent grants for the affected population; remove any recently consented third-party applications.
  • Check for mailbox forwarding rules and MFA registration changes within 24h of exposure timestamps.

1 week:

  • Implement Conditional Access policies restricting device code flow to approved device groups; alert on all deviceCode-protocol sign-ins by default.
  • Deploy network controls for newly registered domains (block or alert on domains <30 days old at the proxy/DNS layer) — this single control severs the terminus of these chains regardless of rotation speed.
  • Restrict or monitor Cloudflare Workers and Framer-hosted destinations where business need is absent; both are increasingly abused as reputation-laundering front-ends.
  • Add browser-level HTML smuggling detection (Blob API + Web Crypto API combination) to EDR custom detections, and run targeted user-awareness briefings for the populations that received these lures.

Related Resources

darkwebotx-pulsedarkweb-apthtml-smugglingcloudflare-workers-abusephishing-redirectioncredential-phishingframer-abuse

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action