Schließen
Schließen
Ihr Netzwerk von morgen
Ihr Netzwerk von morgen
Planen Sie Ihren Weg zu einem schnelleren, sichereren und widerstandsfähigeren Netzwerk, das auf die von Ihnen unterstützten Anwendungen und Benutzer zugeschnitten ist.
          Erleben Sie Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            Ein führendes Unternehmen im Bereich SSE. Jetzt ein führender Anbieter von SASE.
            Ein führendes Unternehmen im Bereich SSE. Jetzt ein führender Anbieter von SASE.
            Netskope debütiert als Leader im Gartner ® Magic Quadrant ™ für Single-Vendor SASE
              Generative KI für Dummies sichern
              Generative KI für Dummies sichern
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                Moderne Data Loss Prevention (DLP) für Dummies
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Modernes SD-WAN für SASE Dummies-Buch
                  Modern SD-WAN for SASE Dummies
                  Hören Sie auf, mit Ihrer Netzwerkarchitektur Schritt zu halten
                    Verstehen, wo die Risiken liegen
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        Die 6 überzeugendsten Anwendungsfälle für den vollständigen Ersatz älterer VPNs
                        Die 6 überzeugendsten Anwendungsfälle für den vollständigen Ersatz älterer VPNs
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          Colgate-Palmolive schützt sein "geistiges Eigentum" mit intelligentem und anpassungsfähigem Datenschutz
                          Colgate-Palmolive schützt sein "geistiges Eigentum" mit intelligentem und anpassungsfähigem Datenschutz
                            Netskope GovCloud
                            Netskope erhält die FedRAMP High Authorization
                            Wählen Sie Netskope GovCloud, um die Transformation Ihrer Agentur zu beschleunigen.
                              Let's Do Great Things Together
                              Die partnerorientierte Markteinführungsstrategie von Netskope ermöglicht es unseren Partnern, ihr Wachstum und ihre Rentabilität zu maximieren und gleichzeitig die Unternehmenssicherheit an neue Anforderungen anzupassen.
                                Netskope solutions
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Technischer Support von Netskope
                                  Technischer Support von Netskope
                                  Überall auf der Welt sorgen unsere qualifizierten Support-Ingenieure mit verschiedensten Erfahrungen in den Bereichen Cloud-Sicherheit, Netzwerke, Virtualisierung, Content Delivery und Software-Entwicklung für zeitnahen und qualitativ hochwertigen technischen Support.
                                    Netskope-Video
                                    Netskope-Schulung
                                    Netskope-Schulungen helfen Ihnen, ein Experte für Cloud-Sicherheit zu werden. Wir sind hier, um Ihnen zu helfen, Ihre digitale Transformation abzusichern und das Beste aus Ihrer Cloud, dem Web und Ihren privaten Anwendungen zu machen.

                                      Cloud Abuse: New Technique Using Adobe Acrobat to Host Phishing

                                      Nov 16 2022

                                      Summary

                                      Netskope Threat Labs recently discovered a phishing campaign that is abusing Adobe Acrobat to host a Microsoft Office phishing page. While abusing free cloud services to host malicious content is a popular attack technique, this is the first time we have seen Adobe Acrobat used to deliver malicious content. 

                                      The attack starts with a phishing email that lures the user into opening a PDF file that redirects them to an Adobe Acrobat URL. This URL is hosting a malicious HTML page, which aims to steal Microsoft Office usernames and passwords. Once the victim enters the credentials in the phishing form, they are sent to a PHP page hosted on another website.

                                      Below, is a diagram to illustrate how this attack works:

                                      Summary of the phishing attack.

                                      In January 2022, a similar attack was spotted, where attackers were abusing Adobe Creative Cloud to host malicious PDF files. In the recent campaign spotted by Netskope Threat Labs, attackers are instead abusing Adobe Acrobat to host the malicious HTML files.

                                      Different from Adobe Creative Cloud, attackers can easily create free trial accounts in Adobe Acrobat without having to provide credit card numbers or any additional personal information. Once the account is created, the attackers can host and publicly share files. Netskope Threat Labs tested this technique by creating a free trial account in Adobe Acrobat, then uploading and sharing an HTML file in less than 2 minutes. 

                                      In this blog post, you will find more details about how this attack works.

                                      Details

                                      The attack starts with a phishing email that lures the user into opening an attached PDF file, disguised as a payment receipt. This is a very common social engineering technique that tries to draw the attention of the victim with a fake document related to money, such as an invoice or a receipt.

                                      Phishing email.

                                      The PDF file contains an image and a button that redirects the user to an Adobe URL that will download the phishing page.

                                      PDF redirecting the user to a URL that downloads phishing.

                                      The URL points to a file hosted on Adobe Acrobat, which was uploaded by the attacker.

                                      The HTML file is a phishing page for Microsoft Office, aiming to steal username and password. 

                                      The attack flow involves the victim opening the HTML file locally, however, it’s also possible to access the HTML phishing page through the temporary link created by Adobe Acrobat for the download.

                                      Phishing page hosted with Adobe Acrobat.

                                      Looking at the HTML, we can see that the form submits the sensitive information to a PHP page hosted on another website. There’s also a slightly obfuscated JavaScript responsible for validating the fields.

                                      Part of the phishing HTML page.

                                      Once the victim adds the sensitive data on the phishing page, the data is sent to the attacker via POST request. The phishing also redirects the user to the legitimate Microsoft login page, to avoid raising suspicions.

                                      Phishing redirecting the victim to the legitimate Microsoft login page.

                                      Conclusions

                                      In this blog post, we saw that attackers can easily create free accounts on Adobe Acrobat to host and share malicious files, such as phishing pages. We strongly recommend individuals avoid opening unknown emails, especially if they contain links or attachments. Always be suspicious of files like PDFs and Office documents that require you to do an action, like clicking a button. Last, but not least, never enter sensitive information, such as  username and password, without double checking the URL and making sure it’s a legitimate website. All malicious URLs were reported and promptly taken down by Adobe on November 9, 2022.

                                      Protection

                                      Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads. 

                                      IOCs

                                      URLs

                                      hxxps://acrobat.adobe[.]com/link/track?uri=urn:aaid:scds:US:6064b327-179c-4834-85ce-37eba11f6902

                                      hxxps://acrobat.adobe[.]com/e54e5be6-270a-4a67-8a60-4a52752b64fe

                                      hxxs://wadweb.com[.]ar/clientes/js.php

                                      author image
                                      Gustavo Palazolo
                                      Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection.
                                      Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection.

                                      Bleiben Sie informiert!

                                      Abonnieren Sie den Netskope-Blog