Zurück 
Netskope Threat Research Labs recently posted an article, detailing the CloudPhishing Fan-out resulting from Decoy PDF documents. We are observing a growing trend in the use of such PDF decoys that use Cloud Storage services to carry out not only phishing attacks but also infect user devices with malware such as Remote Administration Tools (RATs). These latest threats are taking advantage of many companies’ “default allow” policy for Cloud Storage services and also the use of popular PDF readers. In our research, we identified several PDF decoys using popular Cloud Storage services like Google Drive, OneDrive (and OneDrive for Business), Box, and Dropbox for downloading malicious payloads. We also identified the usage of URL redirection services for retrieving malicious payloads hosted in Cloud Storage services.
In one particularly clever example, the attack delivers a too-small image of a document, and offers the user a magnifier to trick him/her into clicking on a document, as shown in Figure 1.
Figure 1: Enticing document delivered when the user clicks the magnifier
On clicking the “zoom in/out” magnifier option in Figure 1, the victim is pointed to a malicious payload hosted in Dropbox. At the time of analysis, the Dropbox link was down and not serving malware.
The above illustrates one of the tactics and we have been observing a number of similar themed PDF decoys as shown in Figure 2.
Figure 2: Messages displayed to trick users into launch PDF decoy documents
In the following sections of this blog we will detail two cases in which the PDF decoys used Cloud Storage services to download malicious payloads. The malicious payloads resident in the Cloud Storage services as well as an attempt to download them are detected by Netskope Threat Protection as Backdoor.Gen.20002647 and Backdoor.Generckd.3640291.
Delivery of PDF Decoys via E-mail and Cloud Storage services
During our analysis, we found PDF decoys being sent as email attachments to users at various enterprises. Some organizations tend to save email attachments in Cloud Storage services to reduce email storage, collaborate with clients and colleagues more efficiently, and send and receive large email attachments with greater speed and ease. If a PDF decoy gets synced to the Cloud Storage service and then others sync it to their devices in order to collaborate, that can create a dangerous fan-out effect. See how the attack chain also causes a fan-out effect for email attachments within shared users in the cloud, and how enterprises can protect themselves using Netskope Threat Protection, in Figure 3.
