Since late 2024, a sophisticated phishing operation leveraging 260 domains to host over 5,000 weaponized PDF files has targeted users across North America, Asia, and Southern Europe. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Sector-specific targeting prioritized technology firms (34%), financial institutions (28%), and manufacturing entities (19%), likely due to their access to proprietary data and payment systems. Unlike legitimate CAPTCHAs, these images contain hyperlinks masked as validation checks, routing victims to credential-harvesting sites or triggering malware downloads. The campaign’s infrastructure spans 260 domains, including PDF repositories like PDFCoffee and Internet Archive, broadening its reach to users searching within document libraries. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. As phishing tactics grow more sophisticated, proactive threat hunting and cross-industry collaboration remain critical to disrupting the cybercrime lifecycle. Discovered by Netskope Threat Labs, the campaign begins when victims search for documents like user manuals, templates, or forms on search engines. Webflow’s CDN (assets.website-files[.]com) emerged as the primary host, accounting for 42% of phishing PDFs, followed by GoDaddy-associated subdomains. These PDFs embed fake CAPTCHA verification screens that redirect users to phishing pages. “The MSHTA command downloads the next stage PowerShell script, which downloads and executes the Lumma Stealer malware”, researchers said. The malware employs Process Hollowing to inject malicious code into legitimate executables, evading endpoint detection. She is covering various cyber security incidents happening in the Cyber Space. The attacks have impacted 1,150 organizations and 7,000 individuals, with technology, financial services, and manufacturing sectors being the most affected. In a subset of attacks, clicking the CAPTCHA copies obfuscated PowerShell code to the victim’s clipboard.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 28 Feb 2025 08:20:20 +0000