The recent cyber threat activity associated with SERPENTINE#CLOUD has been identified once again, with the attack completing successfully five weeks post-remediation. This resurgence employs ClickFix social engineering tactics, utilizing ephemeral Cloudflare tunnels to deliver multiple Remote Access Trojans (RATs) targeting the same organization. Notably, the attack was caught at an early stage by Huntress, preventing the payload from executing.