Amazon Phishing Scam Via Login Prompts in PDF Docs

ReversingLabs published a blog post analysing a phishing campaign using JavaScript embedded in PDFs to steal credentials. The campaign began with a German-language email masquerading as a tax invoice notification from Amazon Seller Central.

The sender name is spoofed to appear to come from the legitimate Amazon DE marketplace. Attached to the email is a PDF that claims to require you to log into your Seller Central account to view the contents of the document. Within the PDF there is embedded JavaScript attached to the login prompt. The JavaScript is responsible for capturing the provided credentials and sending them in plain text to a remote server.

While this is a simple phishing attempt like other traditional phishing emails, using a document-based vector avoids having to trick users into clicking on suspicious links, which is becoming more difficult as user awareness increases.

Amazon login via PDF ( via reversinglabs.com )
Scan of the SHA256 (below) shows as malicious

Indicators of Compromise

SHA256

  • 3078674d0a85602c12e70d795c1579f18513fcd1a740c638f49b121b853d07be

URLs

  • http://sellercentral.amazon.de.56U8GTHDGT4U7YWEWE84GTYS.abecklink.com/step1.php
  • http://sellercentral.amazon.de.56U8GTHDGT4U7YWEWE84GTYS.abecklink.com

Jason Davies

UK based technology professional, with an interest in computer security and telecoms.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: