Malicious Payload Delivery via Cloudflare Workers/R2

Ethan Andrews@eandrews

•updated Jun 9, 2026•5•0•11

Detects network connections from PowerShell or script interpreters to specific Cloudflare Workers or R2 infrastructure observed hosting steganographic payloads, associated with the 'Evil MSI Background campaign'. This rule identifies attempts to download malicious content from known adversary-controlled Cloudflare resources.