Password stolen. Access blocked
A fake sign-in page captured Cloudflare employee passwords. Another layer stopped access: hardware security keys.
In July 2022, Cloudflare employees received text messages leading to a fake login. Three people entered credentials. The attacker had passwords, but the hardware key requirement stopped access attempts.
A barrier after the mistake
The company reported blocking the domain, resetting exposed credentials, clearing sessions and checking devices. FIDO2 keys bound to the legitimate login domain did not give the fake site the required authentication proof.
Do not assume perfect judgement
NetOpiekun’s lesson: training matters, but safeguards should also work after a human mistake. Effective protection gives responders time rather than depending entirely on one click.
A human mistake need not grant an attacker access.
Deploy without losing recovery access
We recommend starting with administrator accounts and email access. Check support for phishing-resistant authentication in the services used, prepare a securely stored spare key and document what happens when a key is lost.
Pilot sign-in, device changes and account recovery. The emergency process must not let an arbitrary caller bypass strong authentication by contacting support.
Do not wait after entering a password
Recommended response: report immediately, use the known service address and involve the administrator. Based on the findings, revoke sessions, reset credentials and review account activity.
Protection against a fake website is not protection against every attack. A compromised device or session requires separate investigation. Employees need to know whom to contact and should not feel compelled to hide a mistake.
About this account
Based on the public report named below. The account concerns the period covered by that report; NetOpiekun recommendations are identified separately. This is not our client work or a description of the organisation’s current systems.
Sources: Cloudflare — The mechanics of a sophisticated phishing scam and how we stopped it, 9 August 2022