Poorly crafted phishing campaign leverages bogus security incident report

Attackers used a fake PDF incident report hosted on AWS to scare victims into enabling 2FA, though a poorly crafted phishing campaign.

Freelance security consultant Xavier Mertens reported a phishing campaign using a fake PDF security incident report hosted on AWS to scare victims into enabling 2FA. The researchers pointed out that the campaign appears poorly crafted.

The phishing message contains a link that leads to an AWS-hosted page (hxxps://access-authority-2fa7abff0e[.]s3.us-east-1[.]amazonaws[.]com/index.html) and includes a PDF titled “Security_Reports.pdf.”

Mertens states the phishing campaign targets MetaMask users urges them to enable 2FA. The “Security_Reports.pdf” attachment claims unusual login activity to alarm victims. The PDF itself is not malicious and was generated using ReportLab, but it is meant to create fear and push users into following the attacker’s instructions.

Despite the tactic, the campaign is low quality: the sender isn’t spoofed and the PDF isn’t personalized or branded, making the scam easier to spot.

“The goal is simple: To make the victim scary and ready to “increase” his/her security by enabled 2FA.” reads the report published by the researcher. “I had a look at the PDF content. It’s not malicious. Interesting, it has been generated through ReportLab[2], an online service that allows you to create nice PDF documents!”

“Besides the idea to use a fake incident report, this campaign remains at a low quality level because the “From” is not spoofed, the PDF is not “branded” with at least the victim’s email. If you can automate the creation of a PDF file, why not customize it?” he concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, phishing campaign)