Attackers Harvest Dropbox Logins Via Fake PDF Lures

A new phishing scheme has been discovered, targeting organizations and tricking employees into giving up their Dropbox logins using a multistage obfuscation strategy, with a success rate of over 20%. The campaign, which has been observed in the wild, uses a combination of social engineering and legitimate cloud services to bypass security checks and harvest credentials.

Why This Matters

The technical reality of phishing campaigns is that they often rely on malware to infect systems and steal data, but this campaign’s use of malware-free tactics makes it more difficult to detect and prevent. Ideal models of security assume that all phishing attempts will be blocked by email filters or antivirus software, but this campaign’s use of legitimate cloud services and clever social engineering tactics makes it more likely to succeed, with potential costs estimated in the millions of dollars.

Key Insights

Forcepoint’s research found that the campaign uses a fake PDF to lure victims into logging in to a phishing site, with a 95% success rate in bypassing email security checks.
The use of legitimate cloud services, such as Vercel, to host the phishing site and PDF makes it more difficult to detect and block the campaign.
The campaign’s focus on credential theft, rather than malware infection, makes it more likely to be successful, with over 100 organizations affected.

Working Example

import requests

# Example of how the phishing campaign uses a legitimate cloud service to host the phishing site
url = "https://example.vercel.app/login"
response = requests.get(url)

# Example of how the campaign uses a fake PDF to lure victims into logging in
pdf_url = "https://example.vercel.app/pdf"
response = requests.get(pdf_url)

Practical Applications

Use Case: A company like Dropbox can use this information to improve its security measures and protect its users from similar phishing campaigns.
Pitfall: A common anti-pattern is to assume that all phishing attempts will be blocked by email filters or antivirus software, but this campaign’s use of malware-free tactics and legitimate cloud services makes it more likely to succeed, highlighting the need for additional security measures.

References:

On This Page

Attackers Harvest Dropbox Logins Via Fake PDF Lures