Invoice lure email links SharePoint share to Cloudflare Workers docviewer

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•3

Detects phishing emails that utilize document-themed subjects (e.g., invoices, shared documents) containing Windows Internet Shortcut (.url) attachments that redirect users to Cloudflare Workers-based 'docviewer' pages, often linked in conjunction with suspicious SharePoint file shares.