Hackers Exploiting Popular Document Publishing Sites for Phishing Attacks
Once again demonstrating how threat actors are repurposing legitimate services for malicious ends, threat actors are using digital document publishing (DDP) sites hosted on platforms such as FlipSnack, Issuu, Marq, Publuu, RelayTo, and Simplebooklet for phishing, credential harvesting, and session token theft.
According to Cisco Talos researcher Craig Jackson, hosting phishing lures on DDP sites increases the chance of a successful phishing attack because these sites frequently have a positive reputation, are unlikely to show up on web filter blocklists, and may give users a false sense of security if they recognize them as reputable or familiar.
Although adversaries have previously hosted phishing documents using well-known cloud-based services like Google Drive, OneDrive, Dropbox,...