Attackers used a fake PDF incident report hosted on AWS to scare victims into enabling 2FA, though a poorly crafted phishing campaign.
Freelance security consultant Xavier Mertens reported a phishing campaign using a fake PDF security incident report hosted on AWS to scare victims into enabling 2FA. The researchers pointed out that the campaign appears poorly crafted.
The phishing message contains a link that leads to an AWS-hosted page (hxxps://access-authority-2fa7abff0e[.]s3.us-east-1[.]amazonaws[.]com/index.html) and includes a PDF titled “Security_Reports.pdf.”
Mertens states the phishing campaign targets MetaMask users urges them to enable 2FA. The “Security_Reports.pdf” attachment claims unusual login activity to alarm victims. The PDF itself is not malicious and was generated using ReportLab, but it is meant to create fear and push users into following the attacker’s instructions.
Despite the tactic, the campaign is low quality: the sender isn’t spoofed and the PDF isn’t personalized or branded, making the scam easier to spot.
EXPLORE MORE
Notepad++ patches flaw used to hijack update system
Notepad++ patched a vulnerability that attackers used to hijack its update system…
Key Democratic Senate Candidate’s Campaign Descends Into ‘Complete Chaos’
Just hours before a key jungle primary decided the field for a…
Google: state-backed hackers exploit Gemini AI for cyber recon and attacks
Google says nation-state actors used Gemini AI for reconnaissance and attack support…
German opposition slams spy agency ‘revolution’
The government is seeking broad new powers for the BfV to conduct…
22 Of The Best Stealth Games To Sneak Around In Right Now
Whether it's stalking prey from the shadows or getting in and out…
These Are The World's Safest (And Least Safe) Cities
Doha ranks as the safest major city in the world in 2026,…
“The goal is simple: To make the victim scary and ready to “increase” his/her security by enabled 2FA.” reads the report published by the researcher. “I had a look at the PDF content. It’s not malicious. Interesting, it has been generated through ReportLab[2], an online service that allows you to create nice PDF documents!”
“Besides the idea to use a fake incident report, this campaign remains at a low quality level because the “From” is not spoofed, the PDF is not “branded” with at least the victim’s email. If you can automate the creation of a PDF file, why not customize it?” he concludes.
