Cloudflare Turnstile iframe lure

Summary

Microsoft takes one landing page apart as a worked example of how such a lure is put together. The visitor meets what appears to be a Cloudflare Turnstile check standing between them and the content. The markup pulls a stylesheet from the Font Awesome library to get the look right, and hides a second document, field.html, inside an invisible frame; that frame draws the tick box and animates a spinner when it is ticked. Ticking it makes the frame post a short message up to the page containing it, and on receiving that message the page writes an obfuscated command into the clipboard through the browser's clipboard interface, then shows the reader the steps for running it. Microsoft dates the page to 22 May 2025 and ties it to no payload family and no actor, so nothing further is claimed here.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is Clipboard injection (T1204.004), which 15 of the 44 published campaigns in this corpus also record (34%).

Indicators

1 indicator, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.