🚨 Hackers are hijacking Cloudflare Tunnel subdomains to launch memory-injected RATs—right through fake PDFs.

The trick? Shortcut files + stealth loaders + Python payloads, all hosted on legit URLs.

CheckDot is SAFU .