Foundation links passport phishing emails to compromised Cloudflare API keys
Summary
The Foundation has reported a phishing incident involving emails that appear to have used compromised Cloudflare API keys, leading to the unauthorized use of personal data. While the organization confirmed that its hardware and funds were secure, it is currently investigating the exact source of the customer details that were flagged by recipients of the phishing emails. In response to the attack, the Foundation revoked all compromised API keys and took measures to dismantle the malicious domain associated with the phishing effort. This incident highlights a broader trend, as Cloudflare services have increasingly been exploited by threat actors for phishing activities in recent campaigns.
Analysis
Cloudflare: Cloudflare provides web performance security and infrastructure services including API management content delivery and edge computing. Its platform was exploited in this event when one or more API keys were compromised allowing unauthorized use to send phishing emails mimicking Foundation. The provider was not the primary target but its infrastructure facilitated the campaign until the keys were revoked. Foundation: Foundation develops human authority hardware devices including the Passport series of Bitcoin hardware wallets and security tools powered by its KeyOS platform. The company focuses on secure self-custody solutions for Bitcoin along with identity and programmable security applications. In this incident Foundation reported phishing emails sent from domains appearing to be its own and traced them to compromised Cloudflare API keys while confirming customer funds and hardware were unaffected. Customer Impact: Recipients flagged the use of personal data in the emails though the exact source of the customer details remains under investigation by Foundation. Phishing Trends: Cloudflare services have seen growing abuse by threat actors for hosting and fronting phishing infrastructure in recent campaigns. Incident Response: Foundation quickly revoked all compromised Cloudflare API keys and arranged for the malicious domain in the emails to be taken down.
Categories
tech
Related sources
- https://foundation.xyz/blog/foundation-raises-6-4m-human-authority-hardware-launch
- https://ringsafe.in/cloudflare-fronted-phishing-in-2026-how-workers-pages-tunnels-and-r2-became-default-phishing-infrastructure/
- https://x.com/realDougStewart/status/2114568924910199024
- https://cybersecuritynews.com/hackers-abuse-cloudflare-services/amp/
- https://foundation.xyz/app-showcase
- https://x.com/FoundationHQ/status/2114564656199069844
- https://www.zawya.com/en/press-release/companies-news/cloudflare-joins-global-operation-to-disrupt-eviltokens-phishing-as-a-service-platform-designed-to-bypass-mfa-1168379
- https://foundation.xyz/blog/passport-is-now-passport-core
- https://www.buybitcoinsmart.com/wallets/foundation-passport