Amazon Phishing Scam Via Login Prompts in PDF Docs
ReversingLabs published a blog post analysing a phishing campaign using JavaScript embedded in PDFs to steal credentials. The campaign began with a German-language email masquerading as a tax invoice notification from Amazon Seller Central.
The sender name is spoofed to appear to come from the legitimate Amazon DE marketplace. Attached to the email is a PDF that claims to require you to log into your Seller Central account to view the contents of the document. Within the PDF there is embedded JavaScript attached to the login prompt. The JavaScript is responsible for capturing the provided credentials and sending them in plain text to a remote server.
While this is a simple phishing attempt like other traditional phishing emails, using a document-based vector avoids having to trick users into clicking on suspicious links, which is becoming more difficult as user awareness increases.
Indicators of Compromise
SHA256
- 3078674d0a85602c12e70d795c1579f18513fcd1a740c638f49b121b853d07be
URLs
- http://sellercentral.amazon.de.56U8GTHDGT4U7YWEWE84GTYS.abecklink.com/step1.php
- http://sellercentral.amazon.de.56U8GTHDGT4U7YWEWE84GTYS.abecklink.com
I am one of the editors here at www.systemtek.co.uk I am a UK based technology professional, with an interest in computer security and telecoms.