Localhost tunnel abuse ledger
11 published reports, from 2021 to 2026, of criminals using ngrok and Cloudflare tunnels for malware delivery, phishing, and ransomware.
Updated October 1, 2026. Licensed CC BY 4.0.
Reports, newest first
Each report was read at its original URL. Dates are the publication date shown on the page. Summaries are paraphrased; malware families, sectors, and scale are listed only where the report states them, otherwise left out.
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
· Microsoft Threat Intelligence
Microsoft describes a ransomware affiliate that installed cloudflared as a persistent service for outbound access and used ngrok to expose RDP before moving laterally and deploying ransomware from several brands.
- Tunnels named
- Cloudflare Tunnel (cloudflared)
- ngrok
- Malware
- Qilin, DragonForce, Anubis, BERT
- Sectors
- healthcare and public health, education, government, financial services, energy, consumer retail, information technology, food and agriculture, consumer services, commercial facilities, non-government organizations, chemicals, critical manufacturing, transportation
- Scale, as reported
- Multiple intrusions in the US, Canada, UK, Spain, the Netherlands, and Puerto Rico; actor tracked since April 2025
Threat Actors Increasingly Abuse Cloudflare Quick Tunnels for Malware Distribution and Post-Compromise Operations
· SpearTip (Zurich Resilience Solutions)
SpearTip's SOC reports attackers using throwaway trycloudflare.com subdomains across several investigations to host malware and tooling, receive uploads, and support post-compromise steps such as hidden admin accounts and attempts to enable RDP.
- Tunnels named
- Cloudflare Quick Tunnels (trycloudflare.com)
- ngrok
- Scale, as reported
- Multiple investigations; 8 malicious quick tunnel subdomains listed
The Unintentional Enabler: How Cloudflare Services are Abused for Credential Theft and Malware Distribution
· Cofense
Cofense Intelligence reviews how attackers use Cloudflare Workers for credential phishing pages and TryCloudflare tunnels to deliver remote access trojans.
- Tunnels named
- Cloudflare Quick Tunnels (TryCloudflare)
- Malware
- Xeno RAT, XWorm
- Scale, as reported
- Cofense's incident data shows 2025 as the peak year for Cloudflare Tunnels and Workers abuse since its tracking began in 2021
Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware
· Securonix
Securonix traces a phishing campaign in which shortcut files pulled scripts over WebDAV from trycloudflare.com subdomains, ending in an in-memory loader for remote access trojans.
- Tunnels named
- Cloudflare Quick Tunnels (trycloudflare.com)
- Malware
- AsyncRAT, RevengeRAT
Threat Actor Abuses Cloudflare Tunnels to Deliver RATs
· Proofpoint
Proofpoint tracked a financially motivated cluster, active since February 2024, that used account-less TryCloudflare tunnels to host WebDAV payloads that installed remote access trojans.
- Tunnels named
- Cloudflare Quick Tunnels (TryCloudflare)
- Malware
- Xworm, AsyncRAT, VenomRAT, GuLoader, Remcos
- Sectors
- law, finance, manufacturing, technology
- Scale, as reported
- Hundreds to tens of thousands of messages per campaign; one July 2024 campaign sent over 1,500 messages
Quartet of Trouble: XWorm, AsyncRAT, VenomRAT, and PureLogs Stealer Leverage TryCloudflare
· eSentire Threat Response Unit
eSentire responded to an infection at a government-sector customer where a phishing chain fetched payloads from a WebDAV server behind TryCloudflare and installed four malware families.
- Tunnels named
- Cloudflare Quick Tunnels (TryCloudflare)
- Malware
- XWorm, AsyncRAT, VenomRAT, PureLogs Stealer
- Sectors
- government
- Scale, as reported
- One customer infection, July 2024
TCP endpoints now require a valid payment card
· ngrok
ngrok began requiring a payment card for TCP endpoints after a sharp rise, from March 2024, in reports that its agent was being used in malware campaigns.
- Tunnels named
- ngrok
- Scale, as reported
- ngrok says 14 of 65 VirusTotal vendors wrongly flagged its agent binary
#StopRansomware: Akira Ransomware
· CISA, FBI, Europol EC3, and NCSC-NL
The joint advisory on Akira ransomware lists ngrok and Cloudflare Tunnel among the tools its operators use to move data out of victim networks; its November 2025 update adds ngrok-based encrypted command-and-control sessions.
- Tunnels named
- ngrok
- Cloudflare Tunnel (cloudflared)
- Malware
- Akira, Akira_v2, Megazord
- Sectors
- education, critical manufacturing, information technology, healthcare and public health, financial services, food and agriculture
- Scale, as reported
- About $244 million in ransom proceeds as of late September 2025 (advisory update of November 13, 2025)
Tunnel Vision: CloudflareD AbuseD in the WilD
· GuidePoint Security
GuidePoint describes intruders running cloudflared on victim hosts for a persistent outbound tunnel that exposes services such as RDP, SSH, and SMB.
- Tunnels named
- Cloudflare Tunnel (cloudflared)
- Scale, as reported
- Multiple incident response engagements (count not stated)
Cybercriminals Exploit Reverse Tunnel Services and URL Shorteners to Launch Large-Scale Phishing Campaigns
· CloudSEK
CloudSEK analyzed over 500 phishing sites served through reverse tunnel services behind URL shorteners, with customers of Indian banks a particular target, with attackers rotating the short-lived tunnel URLs.
- Tunnels named
- ngrok
- localhost.run
- Cloudflare Quick Tunnels (Argo Tunnel)
- Sectors
- banking
- Scale, as reported
- More than 500 phishing sites analyzed
Ngrok Platform Abused by Hackers to Deliver a New Wave of Phishing Attacks
· Cyble
Cyble reported a rise in phishing on random ngrok.io subdomains, including a shared phishing kit, and listed commodity remote access trojans it had seen tunnelling through ngrok.
- Tunnels named
- ngrok
- Malware
- njRAT, DarkComet, Quasar RAT, AsyncRAT, NanoCore RAT
- Sectors
- financial institutions
Sharing without a public tunnel URL
Most of these reports describe attackers using free public hostnames under a trusted domain, and ngrok and Microsoft dev tunnels both describe their visitor warning pages as anti-phishing measures. See how tools compare on that in every way to share localhost.
Frequently Asked Questions
Why do attackers use localhost tunnels?
The reports describe three uses: hosting malware or phishing pages on a free, disposable hostname under a trusted domain; keeping an outbound path into a compromised network; and moving data out. Proofpoint points out that the TryCloudflare tunnels it tracked were created without an account.
Should I block trycloudflare.com or ngrok on my network?
SpearTip recommends blocking *.trycloudflare.com where business needs allow, and the Akira advisory lists ngrok among the tools its operators use. Whether to block depends on whether your developers rely on those services.
How are entries chosen?
Each entry is a report by a security vendor, a government agency, or the tunnel provider itself, read at its original URL. We list malware, sectors, and scale only where the report states them.
Cite this
LayerV (2026). Localhost tunnel abuse ledger. https://layerv.ai/research/tunnel-abuse-ledger (updated 2026-10-01). CC BY 4.0.