- ZIMPERIUS Research finds Smishing campaign that utilizes carefully designed PDF files
- The campaign mimics USPS
- The goal of the campaign is to steal login -legitimation information
Company E -mail accounts may be under the waking eye of different security solutions, but mobile devices do not enjoy the same level of protection, experts have warned as criminals have devised advanced, complex mobile phishing attacks to steal valuable login -credentials.
CyberSecurity scientists at Zimperium recently discovered a new campaign using a unique obscurity technique -they would first build a PDF file that mimics the United States Postal Service (USPS). The structure of the file is quite complicated, the researchers said as it has a headline, body, cross -hearing table and a trailer. The link leading to a malicious destination page is embedded without using the standard /URI mark, making detection and forensic technique somewhat more difficult.
The unique thing about the attack is seen in the URL, which comes with an embedded XOBJECT. This allows the villains to transform it into a clickable button.
SMS -Messages and PDF files
The attack starts with an SMS message instead of an E email. In this way, threat actors are able to bypass any E -Mail -Safety Protection created, but also presents two unique challenges: one -they need to know their victims’ phone numbers, and two -to send SMS messages in bulk is not as cheap, easy, or private as sending e emails.
In the SMS message, the striker mimics the USPS and warns on the usual scam the victims of a package. They share the link to the PDF, which then leads to a malicious destination page where the victims end up sharing their login credentials. This information is ultimately encrypted and forwarded to the striker-owned C2 server.
This campaign highlights the fact that phishing -attacks can happen anywhere, not just IE email, and that companies need to expand their training sessions to cover virtually all communication platforms in use today.
