Hackers Abuse Autodesk Drive For Hosting Weaponized PDF Files

Autodesk Drive is a data-sharing platform for organizations to share documents and files in the cloud.

It also supports 2D and 3D data files, including PDF files, which are free to use when other Autodesk products are subscribed.

However, a new attack campaign has been discovered.

This campaign abuses this Autodesk hosting platform to host malicious PDF files, which leads to phishing attacks on victims.

This phishing attack is aimed explicitly at harvesting Microsoft login credentials.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

Technical Analysis

According to the reports shared with Cyber Security News, threat actors have been using compromised email accounts to find and target new victims.

Using compromised email accounts makes it less suspicious for users to visit the embedded Autodesk links. 

The emails sent by the threat actors from these compromised accounts also include the legitimate email signature footer.

When victims click on the Autodesk drive links on these emails, they are taken to the links to view the PDF document, which mainly contains the sender’s name and the company they work for to add trust to the phishing attack.

This PDF link will contain a “VIEW DOCUMENT” option, which embeds another phishing link that will take the visiting user to a Microsoft Login form.

This form looks exactly like the original Microsoft login form, in which the victim is asked for their username and password.

After entering their credentials, they are taken to a book about real estate investment hosted on Microsoft’s One Drive service.

Since OneDrive is a Microsoft-owned product, it gives the impression to the user that the document they saw was intended.

However, threat actors have harvested the credentials through the Spoof form.

Post Phishing Tactics

As threat actors now have the victim’s Microsoft credentials, they can use them to gain unauthorized access to sensitive company information and send many more phishing emails to target privileged Microsoft accounts.

A different behavior was noticed, which was the difference in languages. 

Threat actors are observed to have automated this phishing email, which changes the languages by using the sender’s locale.

To add proof to this speculation, a similar phishing email was sent from a Canadian manufacturing company that used French in the PDF.

Organizations and employees are advised to be aware of phishing attacks.

Additionally, every login form URL must be verified before entering the credentials. 

Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo