Credential Phishing Campaign Leverages Symantec Security Feature

Summary

Armorblox researchers discovered a credential phishing campaign with a real estate theme. The email contains a link to a PDF that purportedly contains building project bid details. If clicked, the user is led through five redirects. The user eventually lands at a spoofed OneDrive or Adobe login page that steals the user’s credentials, if entered. The threat actor leverages Symantec’s Click-time URL Protection to rewrite the URL – a technique used to disguise the final malicious site and to appear legitimate. Additionally, to add credibility, the email contains a notice that it was scanned by Symantec email security cloud service, though the included domain is nonexistent.

Recommendations

The NJCCIC reminds users to avoid clicking links or opening attachments delivered with emails from unknown senders and exercise caution with emails from known senders. If you are unsure of an email’s legitimacy, contact the sender via a separate means of communication. Additional details can be found in the Armorblox blog post.