Laudian
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
As @Leo said, it's quite common that the malware deletes itself after doing what it's supposed to do to avoid detection.
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
They could've gotten access weeks ago, copied the API key and only acted now.
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
The routes were created march 10th, so it started 3 days ago. Might have gotten the access sooner than that.
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
Not physically, via malware.
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
They probably had access to your computer at one point.
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
That's very very unlikely. In that case, you'd have a lot more sites infected, and also very large sites.
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
Nothing found doesn't mean there is nothing 😉
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
With 2FA enabled, I think the most likely cause is malware on your pc, however it may have gotten there.
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
I've seen quite a few sites with these fake captchas in the last few days.
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
phone is up to date?
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
anyone except you using the computer?
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
And in the tools section of WAF?
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
Also Security --> WAF -> Custom Rules and Managed Rules
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
I'm still looking through the logs btw. There's a lot about rulesets updates. Can you check in the Rules section if you see anything?
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
Can you check if any custom hostnames have been added to your account? Account home -> select domain -> ssl/tls -> custom hostnames
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
Can you check in the audit log when and how it was created? https://dash.cloudflare.com/?to=/:account/audit-log
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
I don't think the order matters^^
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
Click on the worker, go to settings and then at the bottom
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
I'd also check your computer with malwarebytes
125 replies
CDCloudflare Developers
•Created by ian on 3/13/2025 in #general-help
Urgent: Malicious Script Injection Only on HTTPS (Cloudflare Issue?)
look on my screenshot
125 replies