Hackers are exploiting Adobe Creative Cloud to harvest user credentials
New campaign hides links to credential harvesting pages inside PDF files
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Hackers have come up with a new way to leverage the popularity ofAdobe Creative Cloudto bypass email security solutions and harvest user credentials.
Beginning in December of last year, Checkpoint-ownedAvananobserved a new wave of hackers creatingAdobeaccounts for nefarious purposes. After creating an account, the hackers then import aPDF fileinto Adobe’scloud storagewhich contains links to sites used to harvest the credentials of unsuspecting users.
By sharing files containing malicious links using Adobe Creative Cloud, attackers are able to appear legitimate to potential victims while also ensuring that their emails will be able to bypass Advanced Threat Protection (ATP) and otherendpoint protection software.
Hiding credential harvesting pages
In a newblog post, Avanan explains that these attacks begin with an innocent-looking PDF sent via Adobe Acrobat and shared with a user over email. These emails arrive directly from Adobe and asense of urgencyis instilled by an attacker to trick potential victims into opening them.
When a user clicks “Open”, they are redirected to a fakeAdobe Document Cloudpage where they’ll need to click on another button to access their document. While a discerning user may notice the spelling and formatting errors, those in a hurry might click through without thinking. If they do, they are then redirected to a classic credential harvesting page hosted outside of Adobe Creative Cloud where they’re prompted to log in and in doing so, give up their email address and password to an attacker.
Over the course of last few weeks, Avanan has observed thousands of these attacks including 400 in 2022 alone.
To avoid falling victim to this and other similar attacks, end users should carefully inspect all Adobe Creative Cloud pages for grammar and spelling, hover over links to ensure the intended page is legitimate and ensure theirantivirus softwarecan open PDF files in asandboxand inspect all links contained within them.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
We’ve also highlighted thebest firewall,best endpoint protection softwareandbest malware removal software
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Another reason to avoid edge-lit 4K TVs: they may fail faster than others, according to this report
