Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling

One campaign uses HTML smuggling to hide the phishing content from network inspection. The other uses a method called transparent phishing, where the attacker uses Cloudflare Workers to act as a reverse proxy server for a legitimate login page.