Locked PDF Phishing Attack

Wednesday Jan 4th, the SANS Internet Storm Center warned about an active phishing campaign that has malicious PDF attachments in a new scam to steal email credentials.

The SANS bulletin said that the email has the subject line “Assessment document” and the body contains a single PDF attachment that claims to be locked. A message reads: “PDF Secure File UNLOCK to Access File Content.”

John Bambenek, a handler at SANS Internet Storm Center said: “This is an untargeted phishing campaign. They are not going after the most sophisticated users. They are going after Joe Cubicle that may not think twice about entering credentials to unlock a PDF,”

This is a large spray-and-pray campaign that hopes to get a small foothold into your org via an email account and then compromise, tunnel in or send spear-phishing attacks. Here is how it looks:

It doesn’t matter what email address or password you input into the fake unlocking mechanism. The document is opened and anything you input is transmitted to the spammer,” Bambenek said.

Workstations that use the Adobe PDF reader are cautioned via a security warning dialogue box before opening. The Adobe message reads: “The document is trying to connect to… If you trust the site, choose Allow. If you do not trust the site, choose Block.”

However, Bambenek points out that Windows 10 by default uses the Edge browser, and when Edge opens the VetMeds PDF, unlike with Adobe, no warning message is presented to the user.

SANS says they do not know exactly how big the campaign is, but over the past few days, SANS has been forwarded a number of these phishing emails from across America.

“Be wary of emails from domains that don’t match the contents, note that encrypted PDF documents are not locked this way (and will never ask you for your actual email password anyway), and look for other inconsistencies that give these away as scams,” he advises.

Remember, Think Before You Click!

You need to stay alert and keep your "human firewall" on their toes with security top of mind.

This message is brought to you by KnowBe4