Hackers Target European Cybersecurity Firms Using Cisco and Cloudflare Services in Phishing Attacks

European cybersecurity firms have recently been targeted in sophisticated phishing attacks. The hackers disguise their lures as JPMorgan financial documents to exploit victims’ trust in banking information and induce them to click. The incidents highlight how attackers are abusing legitimate cloud services from Cisco, Cloudflare and Nylas to reduce the likelihood that malicious traffic will be blocked.

The newly disclosed attack chain redirects victims multiple times through Cisco, Cloudflare and Nylas services before sending them to a fake Microsoft 365 login page designed to steal usernames and passwords. Reports have not disclosed the exact dates of the attacks, the names of the affected organizations, the number of people impacted or the amount of losses. Investigators are still focused on whether the stolen credentials have been further abused.