Phishing attacks have evolved into increasingly sophisticated schemes to trick users into revealing their personal information.
One such method that has gained prominence involves phishing emails masquerading as PDF viewer login pages.
These deceptive emails lure unsuspecting users into entering their email addresses and passwords, compromising their online security.
Forcepoint X-Labs has recently observed many phishing emails targeting various government departments in the Asia-Pacific (APAC) region.
These emails masquerade as PDF viewer login pages, with the primary goal of harvesting user credentials.
The phishing emails were found to originate from the same sender, hachemi52d31[at]live[.fr].
When users open the HTML file attached to the phishing email in a web browser, they are presented with a fake login page asking them to verify their password.
The primary purpose of this page is to collect the victim’s credentials. Below is an example of the HTML code used in these phishing scams:
The code above is an obfuscated JavaScript designed to mask its true intent. By decoding the obfuscated parts, we can understand its functionality.
Forcepoint customers are protected against this threat at various stages of the attack:
This code is designed to phish for user credentials and should not be trusted or used.
If you encounter this or similar code in the wild, report it to relevant authorities and avoid interacting with the site.
Do not enter personal information into websites or forms you do not fully trust, and always verify the legitimacy of the sites you visit, especially when asked for sensitive information.