Possible AvisLoader executable payload retrieval via Cloudflare Quick Tunnel or Workers.dev host

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•1

Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.