Inside a purchase order PDF phishing campaign

A Malwarebytes investigation into a phishing campaign centred on a PDF purchase order reveals a lure named “NEW Purchase Order # 52177236.pdf” that prompted recipients to view a supposed order. The campaign relied on a phishing webpage opened from the PDF’s long URL, which ultimately displayed a login form with the target’s email address pre-filled, aimed at harvesting business credentials.

Harvested data included the user’s browser, operating system, language, cookies, screen size and location, with credentials posted directly to the attacker’s Telegram bot and forwarded to a Telegram chat, where the chat ID was hardcoded as 5485275217. The attackers used a subdomain under ionoscloud[.]com, belonging to IONOS Cloud, as part of the hosting for the phishing page, a tactic chosen to leverage the “halo effect” of a well-known domain.

The investigation also notes an obfuscated JavaScript layer of about 113,184 lines, which was deobfuscated to reveal the form and the harvesting script, and that the collected data was sent to the attacker’s Telegram account. According to Malwarebytes, the guidance includes treating PDFs with caution, verifying sender authenticity, and employing real-time anti-malware and email security solutions.