Efforts such as raising awareness of phishing have yielded the desired results, but cybercriminals continue to find new ways to design attacks.Recent attacks using PDF attachments are designed to trick users into entering their email account credentials into elaborate phishing pages. Before continuing, you can take a look at what phishing is and how to spot phishing attacks.
Social engineering uses PDF for phishing
In the new phishing attack, the PDF looks like a protected Excel file that can only be displayed in Microsoft Excel after entering your email credentials. The attachment is mostly carried over via email, which pretends to be an official message that mimics authenticity. It encourages the potential victim to open the file by following the link suggested in the PDF file.
When the user tries to open the attachment, an error message is displayed that instructs the user to “open the document” in Microsoft Excel. ” In fact, this is a link to the site.
For an informed user, such an event is sufficient to raise the alarm, since Adobe Reader is being used to read the PDF file, not the Excel file.
Clicking on the link will open your browser and be taken to a web page where the social engineering attack will continue with a message stating that the document is protected as it is confidential and therefore you need to log in with your email credentials.
Why is this social engineering method used? It involves human error, so preventing these attacks can be difficult for businesses. In addition, it triggers urgency, fear and other similar negative emotions in the victim, forcing him to quickly reveal sensitive information by clicking a malicious link or opening a malicious file.
Once you enter the information and a cybercriminal gains access to your email, they can launch new phishing attacks on your contacts or access your online banking.
Microsoft Edge uses SmartScreen technology to block these phishing pages from loading. This way, users using the Edge browser to browse the web do not need to worry. In addition, the latest versions of popular browsers such as Mozilla Firefox and Google Chrome are equipped with the necessary tools to prevent phishing incidents. Therefore, it is recommended to always use the latest version of modern internet browsers.
Additionally, Windows Defender can detect and block malicious PDF attachments and other malicious code.
The second method involves small changes where the PDF prompts the user to click a link that presumably leads them to a location where they can view a Dropbox-hosted document online. Again, this is where the user is redirected to a phishing page that “allows” them to view the document only if they enter their correct email credentials.
Awareness is the key here. You should be looking for a url. If it uses HTTP and not HTTPS, then it’s not a secure session, but a carefully crafted phishing page. Close the page now and exit!
You can get more information on this at Technet Blogs.
How to protect yourself from phishing attacks
Social engineering attacks are designed to take advantage of the fear that leads to possible error in decision making. So awareness is the key. Never open email attachments or follow links in suspicious emails. Additionally, the security features in Windows 10 can help you identify and stop phishing attacks. Read this post to learn how to protect yourself from social engineering attacks.
