Threat Actors Abuse Document-Publishing Sites to Steal Credentials and Session Tokens
Summary
Talos observed phishing campaigns abusing legitimate document-publishing sites to host lures that redirect victims to credential- and session-token-harvesting pages, often impersonating Microsoft 365. The article details attack patterns, case studies, and defensive меры
Key points
- Talos observed attackers using legitimate services including Publuu, Marq, Issuu, FlipSnack, RelayTo, and SimpleBooklet to host phishing documents.
- Email lures link to browser-based flipbooks, which direct victims—sometimes through redirects or Cloudflare CAPTCHAs—to attacker-controlled authentication pages.
- The credential-harvesting pages often impersonate Microsoft 365; some campaigns appear designed to capture session tokens as well as credentials.
- Attackers customize document pages and lures for credibility, and may use compromised email accounts to target an initial victim and then their business contacts.
- Free accounts, favorable site reputations, short-lived pages, and features that obscure link destinations make these services useful to attackers and challenging for defenders.
- Talos recommends monitoring email links to document-publishing sites, quickly blocking malicious domains, using threat intelligence, and updating user awareness training.
Article Details
- Attack Vectors
- Phishing emails link to documents hosted on legitimate digital document publishing sites; those documents link onward to attacker-controlled credential- or session-token-harvesting pages.
- Some attack chains route victims through redirects and Cloudflare CAPTCHAs before presenting spoofed authentication pages.
- The reported lures imitate Microsoft 365, SharePoint, eFax, and online fax documents, and may be customized with a target organization's name.
- The article describes follow-on attacks using access to a compromised legitimate email inbox and relationships of an initial victim, as a cascading business email compromise process.
- Defensive Notes
- Block commonly abused digital document publishing sites where business operations do not require access; otherwise, rapidly block malicious domains identified in hosted lures.
- Configure email security controls to detect and alert on email links to common digital document publishing sites.
- Use threat intelligence to identify newly created sites related to known threats and monitor internal behavioral trends that may indicate coordinated activity.
- Update user awareness training to cover cloud-hosted phishing methods and unusual document-sharing sites, and encourage reporting of suspicious emails.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 347nsm239mws934[.]top | Example attacker-used .top domain serving a spoofed Microsoft authentication page. |
| DOMAIN | aerospace-atlas[.]online | Domain hosting a credential-harvesting page associated with an Issuu phishing lure. |
| DOMAIN | afurrytailwedding[.]com | Attacker-controlled page associated with a SharePoint-themed credential-harvesting lure. |
| DOMAIN | atlas-aerspace[.]online | Attacker-controlled domain hosting a spoofed authentication page associated with a DDP phishing lure. |
| DOMAIN | mvnwsenterprise[.]top | Attacker-controlled domain hosting the identified credential-harvesting URL. |
| DOMAIN | onedrivemwsamc[.]top | Example attacker-used .top domain serving a spoofed Microsoft authentication page. |
| DOMAIN | onedrivesmncs[.]top | Example attacker-used .top domain serving a spoofed Microsoft authentication page. |
| DOMAIN | secure-docsx[.]com | Domain used in a phishing link embedded in RelayTo-hosted lures. |
| DOMAIN | secure-docu[.]com | Related domain created after secure-docsx[.]com and sharing registrant details, in the context of the reported RelayTo phishing activity. |
| DOMAIN | webwave[.]dev | Unrelated subdomain hosting a credential-harvesting page that nearly replicated a Canadian telecom provider's login page. |
People
Products
Cisco Secure EndpointBlock common DDP sites via border security devices, endpoint detection and response (EDR) like Cisco Secure Endpoint, web content filtering, and/or DNS security controls if access to these sites is not required forDocuSignon well-known cloud storage and contract management sites such as Google Drive, OneDrive, SharePoint, DocuSign and Oneflow. However, DDP sites could represent a blind spot for defenders, because they are unfamiliarFlippingBooktypes of interaction with the document. Examples of DDP sites include Publuu, Marq, FlipSnack, Issuu, FlippingBook, RelayTo and SimpleBooklet.FlipSnackthat allow other types of interaction with the document. Examples of DDP sites include Publuu, Marq, FlipSnack, Issuu, FlippingBook, RelayTo and SimpleBooklet.Google Drivetactic of deploying phishing lures on well-known cloud storage and contract management sites such as Google Drive, OneDrive, SharePoint, DocuSign and Oneflow. However, DDP sites could represent a blind spot forIssuuother types of interaction with the document. Examples of DDP sites include Publuu, Marq, FlipSnack, Issuu, FlippingBook, RelayTo and SimpleBooklet.Marqincidents in which threat actors used legitimate digital document publishing sites such as Publuu and Marq to host phishing documents as part of ongoing credential and session harvesting attacks. Threat actorsMicrosoft 365After completing the CAPTCHA, the victim is directed to a convincing replica of a Microsoft 365 authentication page. The URL for the page contains a lengthy alphanumeric string, which may act as an identifier for theMicrosoft OneDrivedeploying phishing lures on well-known cloud storage and contract management sites such as Google Drive, OneDrive, SharePoint, DocuSign and Oneflow. However, DDP sites could represent a blind spot for defenders,Microsoft SharePointlures on well-known cloud storage and contract management sites such as Google Drive, OneDrive, SharePoint, DocuSign and Oneflow. However, DDP sites could represent a blind spot for defenders, because they areOneflowcloud storage and contract management sites such as Google Drive, OneDrive, SharePoint, DocuSign and Oneflow. However, DDP sites could represent a blind spot for defenders, because they are unfamiliar to trainedPubluuseveral recent incidents in which threat actors used legitimate digital document publishing sites such as Publuu and Marq to host phishing documents as part of ongoing credential and session harvesting attacks. ThreatRelayTowith the document. Examples of DDP sites include Publuu, Marq, FlipSnack, Issuu, FlippingBook, RelayTo and SimpleBooklet.SimpleBookletthe document. Examples of DDP sites include Publuu, Marq, FlipSnack, Issuu, FlippingBook, RelayTo and SimpleBooklet.