Hackers Use Webflow CDN PDFs with CAPTCHA Tricks to Bypass Security Scanners, here is a Quick Look.

In a recent development, hackers have devised a new method to bypass security scanners by exploiting CAPTCHA tricks on Webflow CDN PDFs. This sophisticated phishing campaign has been ongoing since the second half of 2024 and targets users searching for documents on search engines.

The Attack Mechanism

The attackers utilize search engine optimization (SEO) techniques to lure victims into downloading malicious PDFs hosted on the Webflow Content Delivery Network (CDN).

These PDFs contain fake CAPTCHA images embedded with phishing links. When users click on the CAPTCHA button, they are redirected to a legitimate Cloudflare Turnstile CAPTCHA.

This deceptive step creates an illusion of authenticity, convincing victims that the process is secure. Consequently, after completing the Cloudflare CAPTCHA, victims are redirected to a page offering a file named after their original search query.

To download this file, they must sign up by providing personal information such as their email address and full name.

The Phishing Process

Once users enter their personal information, they are asked to provide their credit card details under the pretense of completing the process. Even after multiple submissions of credit card details, an error message appears, followed by a redirection to an HTTP 500 error page.

The attackers aim to steal credit card information and commit financial fraud. By embedding phishing links within fake CAPTCHAs and redirecting users through real security checks, attackers effectively bypass static scanners and other detection mechanisms.

Impact and Response

This campaign primarily targets industries such as technology, manufacturing, and banking across North America, Asia, and Southern Europe. Netskope Threat Labs reported the malicious URLs to Webflow on January 23, 2025, as part of their ongoing efforts to combat these threats.

The use of fake CAPTCHAs and SEO manipulation in phishing attacks highlights the evolving sophistication of cyber threats. Users must remain vigilant when interacting with documents found through search engines and be cautious of requests for sensitive information, especially when prompted by unfamiliar websites.

Conclusion

The phishing scheme underscores the growing sophistication of cybercriminals in exploiting trusted platforms for malicious purposes. Organizations are advised to educate their employees about such tactics and implement robust security solutions to detect and mitigate these threats.

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it