A report by cybersecurity researchers from GuidePoint reveals that hackers are increasingly using a legitimate feature of Cloudflare, called Cloudflare Tunnels, to steal data and persist on compromised endpoints. The feature allows users to create secure, outbound-only connections to the Cloudflare network for web servers and applications. However, hackers are using it to create a discreet communication channel over which they have full control. GuidePoint has noticed a significant uptick in the use of this technique for data exfiltration and to establish persistence on target devices.