Attackers used a fake PDF incident report hosted on AWS to scare victims into enabling 2FA, though a poorly crafted phishing campaign.
Freelance security consultant Xavier Mertens reported a phishing campaign using a fake PDF security incident report hosted on AWS to scare victims into enabling 2FA. The researchers pointed out that the campaign appears poorly crafted.
The phishing message contains a link that leads to an AWS-hosted page (hxxps://access-authority-2fa7abff0e[.]s3.us-east-1[.]amazonaws[.]com/index.html) and includes a PDF titled “Security_Reports.pdf.”
Mertens states the phishing campaign targets MetaMask users urges them to enable 2FA. The “Security_Reports.pdf” attachment claims unusual login activity to alarm victims. The PDF itself is not malicious and was generated using ReportLab, but it is meant to create fear and push users into following the attacker’s instructions.
Despite the tactic, the campaign is low quality: the sender isn’t spoofed and the PDF isn’t personalized or branded, making the scam easier to spot.
EXPLORE MORE
WATCH: Horror invasion unfolding as tens of thousands of Moroccans swarm Spanish enclave
Reactions are pouring in as the Spanish government struggles to respond to…
FBI warns of surge in ATM Jackpotting, $20 Million lost in 2025
The FBI warns ATM jackpotting is rising nationwide, with over $20 million…
Hollywood’s Quiet Powerhouse: How Frances Fisher Built a Five-Decade Legacy
Few character actresses command the screen with the aristocratic sharpness and emotional…
Anthropic unveils Claude Code Security to detect and fix code bugs
Anthropic launches Claude Code Security, an AI tool that scans code for…
New study discredits LGBT activist claims that ‘anti-transgender’ laws cause suicide
The pro-LGBT Trevor Project continues to promote “research” purporting to link so-called…
HoYoverse’s Pokémon Rival Won Me Over – I Just Need It on PS5
I’ve never played an auto chess game – or auto battler, as…
“The goal is simple: To make the victim scary and ready to “increase” his/her security by enabled 2FA.” reads the report published by the researcher. “I had a look at the PDF content. It’s not malicious. Interesting, it has been generated through ReportLab[2], an online service that allows you to create nice PDF documents!”
“Besides the idea to use a fake incident report, this campaign remains at a low quality level because the “From” is not spoofed, the PDF is not “branded” with at least the victim’s email. If you can automate the creation of a PDF file, why not customize it?” he concludes.
