Attackers often attempt to abuse genuine online document services such as Adobe PDF online to spread malware. In a recent campaign, they are abusing the genuine document signing service, Adobe Acrobat Sign, to deliver the Redline information stealer.
Brief about Adobe Acrobat Sign
- Adobe Acrobat Sign is an e-signature service that allows users to upload documents to the cloud, and share them with intended users for their electronic signatures.
- This free trial service lets users upload their documents to Adobe's public servers located at eu1.documents.adobe[.]com/public/.
- Once the documents are uploaded, users can share them with specific recipients by using Adobe's email-based notification service. This service allows users to include personalized text when sharing their documents.
Coming to the exploit
Avast researchers observed that attackers are abusing this service to distribute Redline. They register for the service via a fake email and upload a document containing a link to their website.
- They invite potential victims to review and sign the document, which is received as a genuine email from Adobe (adobesign@adobesign[.]com).
- The email contains custom text from the attackers, indicating that the reader will need to go through the document before signing it.
- The link in the document takes the victims to another site, protected via a hardcoded CAPTCHA. Subsequently, victims are urged to download a ZIP file that contains Redline.
Highly-focused attacks
The attacks are highly targeted, as attackers continuously make multiple attempts to deploy the malware to the same targeted victim.
- In one specific case, a fake email was received by a popular YouTube channel owner, claiming to be a music copyright infringement notice (hosted on Adobe Acrobat Sign) from a music company.
- When the YouTube channel owner did not click on the link, attackers made another attempt by sending another fake message via another document signing service dochub[.]com. It redirects the user to the Adobe Acrobat Sign document.
- All attempts eventually redirect the victim to the download site hosting Redline.
Recent cloud services abuses
In the past few months, several attackers have targeted cloud-based services to perform various malicious activities, including cryptojacking, malware distribution, and more.
- Last month, a group of mysterious hackers, dubbed Nevada Group, targeted thousands of cloud servers across the U.S. and Europe, by exploiting an easy-to-fix vulnerability.
- Around the same time, China-based 8220 Gang was targeting poorly secured cloud servers with the Tsunami IRC bot and custom cryptominer.
Concluding notes
Abuse of legitimate cloud-based services such as Adobe Acrobat Sign has become one of the favorite tactics for phishing attackers, as it provides a direct way to reach out to the target’s inbox via genuine notification channels. Experts suggest all users be extra cautious when clicking on links received from unknown sources. Furthermore, use a genuine anti-virus service to scan all content received from the internet before it is run on the machine.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/shutterstock_231394741.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/ca9e_shutterstock_687323650.jpg)
