New Phishing Scam Uses Fraudulent PDF Files

Security researcher John Bambenek disclosed a new kind of phishing scam on the SANS Internet Storm Center (ISC) InfoSec Forum last week. Bambenek described an email purportedly sent from VetMeds with the subject line “Assessment document.” The body of the email contains a single, phony PDF attachment created with Microsoft Word that appears to be locked. The email contains a link that purportedly unlocks the PDF content.

How the Phishing Scam Works

When a victim clicks the link, the default PDF viewer is invoked. The embedded link in the document points to chai[.]myjino[.]ru. If Adobe Acrobat is invoked, it prompts the victim that the document is trying to redirect to another site and offers an option to accept or decline. SANS handlers noted that this does not occur in Microsoft Edge, which is the default PDF viewer for Windows 10.

Once the victim arrives at the site, a dialog box appears above the PDF that allegedly needs to be opened. This box prompts the victim to enter an email address and password. This data is forwarded to the spammer, no matter what the victim enters into the fake unlocking mechanism.

If the document is opened, it appears to be a Russian Society for Worldwide Interbank Financial Telecommunication (SWIFT) banking transaction. Why this particular document appears is a mystery.

Targeting Joe Cubicle

“This is an untargeted phishing campaign,” Bambenek told Threatpost. “They are not going after the most sophisticated users. They are going after Joe Cubicle that may not think twice about entering credentials to unlock a PDF.”

The SANS post offers no information about the scope of this attack. Bambenek said, however, that SANS has been forwarded a number of these particular emails in the past few days from across the country.

Users should be careful not to open emails from unfamiliar domains. Additionally, remember that encrypted PDF documents are not typically locked behind a login screen.

Larry Loeb

Principal, PBC Enterprises

Hive0137 and AI-supplemented malware distribution

12 min read - IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former…

Unveiling the latest banking trojan threats in LATAM

9 min read - This post was made possible through the research contributions of Amir Gendler.In our most recent research in the Latin American (LATAM) region, we at IBM Security Lab have observed a surge in campaigns linked with malicious Chrome extensions. These campaigns primarily target Latin America, with a particular emphasis on its financial institutions.In this blog post, we’ll shed light on the group responsible for disseminating this campaign. We’ll delve into the method of web injects and Man in the Browser, and…

Crisis communication: What NOT to do

4 min read - Read the 1st blog in this series, Cybersecurity crisis communication: What to doWhen an organization experiences a cyberattack, tensions are high, customers are concerned and the business is typically not operating at full capacity. Every move you make at this point makes a difference to your company’s future, and even a seemingly small mistake can cause permanent reputational damage.Because of the stress and many moving parts that are involved, businesses often fall short when it comes to communication in a crisis.…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

How the Phishing Scam Works

Targeting Joe Cubicle

More from

Hive0137 and AI-supplemented malware distribution

Unveiling the latest banking trojan threats in LATAM

Crisis communication: What NOT to do

Topic updates