NewsJanuary 9, 2017 @ 12:10 PM

New Phishing Scam Uses Fraudulent PDF Files

Security researcher John Bambenek disclosed a new kind of phishing scam on the SANS Internet Storm Center (ISC) InfoSec Forum last week. Bambenek described an email purportedly sent from VetMeds with the subject line “Assessment document.” The body of the email contains a single, phony PDF attachment created with Microsoft Word that appears to be locked. The email contains a link that purportedly unlocks the PDF content.

How the Phishing Scam Works

When a victim clicks the link, the default PDF viewer is invoked. The embedded link in the document points to chai[.]myjino[.]ru. If Adobe Acrobat is invoked, it prompts the victim that the document is trying to redirect to another site and offers an option to accept or decline. SANS handlers noted that this does not occur in Microsoft Edge, which is the default PDF viewer for Windows 10.

Once the victim arrives at the site, a dialog box appears above the PDF that allegedly needs to be opened. This box prompts the victim to enter an email address and password. This data is forwarded to the spammer, no matter what the victim enters into the fake unlocking mechanism.

If the document is opened, it appears to be a Russian Society for Worldwide Interbank Financial Telecommunication (SWIFT) banking transaction. Why this particular document appears is a mystery.

Targeting Joe Cubicle

“This is an untargeted phishing campaign,” Bambenek told Threatpost. “They are not going after the most sophisticated users. They are going after Joe Cubicle that may not think twice about entering credentials to unlock a PDF.”

The SANS post offers no information about the scope of this attack. Bambenek said, however, that SANS has been forwarded a number of these particular emails in the past few days from across the country.

Users should be careful not to open emails from unfamiliar domains. Additionally, remember that encrypted PDF documents are not typically locked behind a login screen.

Share this Article:
Larry Loeb

Principal, PBC Enterprises

Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. He wrote for IBM's DeveloperWorks site for seven years and has written a book on the Secure Electronic Transaction Internet protocol. His latest book has the commercially obligatory title of Hack Proofing XML. He's been online since uucp "bang" addressing (where the world existed relative to !decvax), serving as editor of the Macintosh Exchange on BIX and the VARBusiness Exchange.