ARToken Cloudflare Workers docviewer Phishing Page Access

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•2

Detects network activity associated with a phishing campaign leveraging Cloudflare Workers, identified as 'ARToken'. The rules monitor for specific TLS SNI patterns, HTTP Host headers, and subsequent C2-like behavior involving device code authentication flows (api/device/start and api/device/poll) hosted on 'workers.dev'.