cloudndmcedu@1.0.0

Analysis

cloudndmcedu@1.0.0 ships a single obfuscated index.html that impersonates a Cloudflare Turnstile CAPTCHA challenge page. Its JavaScript reads the current page URL's query parameters, appends them to an attacker-controlled destination URL, and redirects the visitor there after the fake challenge completes, using AES encryption with a hardcoded key to protect the collected parameters. This is a credential-harvesting phishing page designed to capture tokens/credentials passed in the URL and forward them to the attacker.