Beware of Fake Dropbox Phishing Attack that Harvest Login Credentials

A new phishing campaign targeting Dropbox users has been identified, employing a sophisticated multi-stage approach to obtain login credentials. This campaign leverages trusted cloud platforms and seemingly benign PDF files to deceive users into accessing a fraudulent login page.

The phishing attack begins with a legitimate-appearing email, often related to procurement processes, which includes a PDF attachment. Recipients are instructed to review request orders by signing in with their credentials. This email does not contain any direct malicious links, allowing it to pass authentication checks such as SPF, DKIM, and DMARC without detection.

Upon opening the PDF, users encounter an embedded link leading to another PDF hosted on Vercel Blob storage, a legitimate cloud service. This intermediate step plays on user trust in well-known platforms. The PDF employs techniques like FlateDecode compression and AcroForm objects to mask clickable elements from scanning tools.

Once users are redirected to the fake Dropbox login page, which mimics the authentic interface, they are prompted to enter their credentials. The page contains concealed JavaScript code that collects the email and password, validates the email format, and gathers additional information such as IP address and geo-location through external APIs.

This data is then transmitted to attackers via a Telegram bot using hardcoded credentials. A simulated login process with a delay is used to make victims believe an error occurred due to mistyped credentials, while the attackers have already captured the data.

This phishing campaign underscores the importance of vigilance and the need for enhanced security measures to protect against sophisticated deception techniques that exploit user trust in cloud platforms.

Based on reporting by Cyber Security News.