ARToken docviewer lure on workers.dev serving Cloudflare Turnstile gate

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•3

This rule detects network traffic patterns associated with the ARToken phishing campaign, specifically identifying access to lure pages hosted on 'workers.dev' domains with 'docviewer' in the hostname and 'turnstile' challenge responses in the HTTP body, which is used for anti-analysis/evasion.