January 9, 2017 By Larry Loeb 2 min read

Security researcher John Bambenek disclosed a new kind of phishing scam on the SANS Internet Storm Center (ISC) InfoSec Forum last week. Bambenek described an email purportedly sent from VetMeds with the subject line “Assessment document.” The body of the email contains a single, phony PDF attachment created with Microsoft Word that appears to be locked. The email contains a link that purportedly unlocks the PDF content.

How the Phishing Scam Works

When a victim clicks the link, the default PDF viewer is invoked. The embedded link in the document points to chai[.]myjino[.]ru. If Adobe Acrobat is invoked, it prompts the victim that the document is trying to redirect to another site and offers an option to accept or decline. SANS handlers noted that this does not occur in Microsoft Edge, which is the default PDF viewer for Windows 10.

Once the victim arrives at the site, a dialog box appears above the PDF that allegedly needs to be opened. This box prompts the victim to enter an email address and password. This data is forwarded to the spammer, no matter what the victim enters into the fake unlocking mechanism.

If the document is opened, it appears to be a Russian Society for Worldwide Interbank Financial Telecommunication (SWIFT) banking transaction. Why this particular document appears is a mystery.

Targeting Joe Cubicle

“This is an untargeted phishing campaign,” Bambenek told Threatpost. “They are not going after the most sophisticated users. They are going after Joe Cubicle that may not think twice about entering credentials to unlock a PDF.”

The SANS post offers no information about the scope of this attack. Bambenek said, however, that SANS has been forwarded a number of these particular emails in the past few days from across the country.

Users should be careful not to open emails from unfamiliar domains. Additionally, remember that encrypted PDF documents are not typically locked behind a login screen.

More from

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today