What’s Going On?

Attackers send phishing emails that appear to come from trusted brands. Each email contains a PDF attachment crafted with official-looking branding and instructions that pressure the recipient to “call support.” On the surface, the message may appear to offer account verification or transaction support, but it conceals a VOIP-controlled number linked to threat actors.

Inside the PDFs, recipients may also find QR codes or embedded links redirecting to fake login portals. These use PDF annotations like sticky notes or form fields, making them appear as legitimate customer service prompts. Once a target calls the number, a cybercriminal adopts the persona of a support representative, equipped with scripted dialogues, spoofed caller IDs, and even hold music that lends credibility to the interaction.

Why It Works So Well

This TOAD approach works by exploiting our trust in phone communication. While email phishing has become widely understood, receiving a call feels more trustworthy—and attackers here exploit that vulnerability. Live conversations enable real-time manipulation of emotions, urgency, and compliance during the call.

Tangibly harmful outcomes follow. Some attackers push for banking trojans on Android, while others install remote access tools on PCs, granting persistent control. The FBI has flagged a group called Luna Moth, using similar tactics—posing as IT staff to infiltrate networks.

Brands Under Fire

During the analyzed period, Microsoft and DocuSign were the most frequently spoofed brands via PDF‑based phishing. Other targets included NortonLifeLock, PayPal, and Geek Squad. Additionally, attackers are creatively twisting PDFs using annotations to embed QR codes that masquerade as legitimate links, pointing to credential-harvesting sites or fake Microsoft login pages.

Technical Tactics & Innovation

• PDF Annotation Abuse: Hackers insert QR codes and links through sticky notes or form fields, creating fake yet convincing prompts.
• VoIP and Spoofed Caller IDs: To preserve anonymity and replicate a genuine support line, attackers rely on VoIP numbers and reuse them for days, enabling multi-step attacks.
• M365 Direct Send Exploitation: Some campaigns utilize Microsoft 365’s “Direct Send” feature, enabling internal-looking emails that bypass standard email filters—targeting over 70 organizations since May.

A Broader Phishing Context

This isn’t an isolated trend. Earlier campaigns have used malicious PDFs to carry banking or credential‑stealing payloads. But TOAD represents a more insidious evolution—extending the phishing conversation from email to live phone interaction. By scripting non‑threatening issues and then guiding victims to install remote access tools or fake payment pages, attackers significantly broaden their attack surface.

Defense Is a Process, Not a Feature

According to Talos, brand‑impersonation detection engines are essential in defending against these threats. Additional recommendations for organizations and individuals include:

1. Multi‑Factor Authentication (MFA) – This adds an extra record layer if credentials are compromised.
2. Caller Verification Protocols – Never share personal or system details with unsolicited callers, even if they claim to be from a trusted company.
3. Employee Awareness Training – Equip teams to recognize PDF-based phishing tricks and TOAD methods.
4. Advanced Email Filtering – Especially to catch anomalies from Direct Send or internal-looking messages.
5. PDF Sandboxing and Scanning – Analyze clickable elements in attachments before opening or activating them.

Final Thoughts

The emergence of TOAD via PDF-based phishing highlights how threat actors are linking digital deception with live conversations to build trust and overcome user skepticism. The seamless blend of document lures and human interaction increases the attack’s potency, making it harder to detect and resist.

In response, organizations must adopt layered defenses—leveraging AI‑driven brand impersonation checks, thorough PDF analysis, call‑screening protocols, and robust training. For individuals, the key takeaway is simple: if you receive an unexpected email urging you to call for help, disengage—and contact the company directly through verified channels.

By maintaining skepticism and layered defenses, users and organizations can significantly reduce the success of these increasingly sophisticated phishing schemes.

The post Hackers Are Weaponizing PDF Files for Sophisticated Callback Phishing Campaigns appeared first on CyberHood Sentinel.

Campaign Overview

Initiated in December 2024, the phishing operation, tracked by Microsoft as Storm-1865, specifically targets individuals within hospitality organizations across North America, Oceania, South and Southeast Asia, and Europe. The attackers send deceptive emails purporting to be from Booking.com, addressing topics such as negative guest reviews, account verification, online promotion opportunities, or requests from prospective guests. These emails contain links or PDF attachments that direct recipients to malicious websites designed to mimic legitimate Booking.com pages. ​

The ClickFix Technique

The hallmark of this campaign is the use of the ClickFix social engineering technique. Upon clicking the malicious link, users are presented with a fake CAPTCHA overlay on a webpage resembling Booking.com. To proceed, users are instructed to perform a series of actions:​T

1. Press a keyboard shortcut (e.g., Windows + R) to open the Windows Run dialog.​
2. Paste a command copied to their clipboard by the malicious webpage
3. Execute the command, which initiates the download of malware onto their system.​

This method exploits users’ problem-solving tendencies, prompting them to inadvertently execute malicious code.

Malware Deployed

The campaign delivers various types of malware, including:​

• XWorm: A remote access trojan (RAT) that allows attackers to control infected systems.​
• Lumma Stealer: An information stealer targeting credentials and financial data.​
• VenomRAT and AsyncRAT: RATs facilitating unauthorized access and data exfiltration.​
• Danabot: A banking trojan known for stealing financial information
• NetSupport RAT: A legitimate remote administration tool misused for malicious purposes.​

These payloads enable attackers to harvest sensitive information, conduct financial fraud, and maintain persistent access to compromised systems. ​

Recommendations for Organizations

To mitigate the risks associated with this phishing campaign, organizations, particularly in the hospitality sector, should consider the following measures:

• User Education: Train employees to recognize phishing attempts, especially unsolicited emails requesting urgent actions or containing unexpected attachments or links.​
• Email Filtering: Implement advanced email filtering solutions to detect and block phishing emails before they reach end-users.​
• Endpoint Protection: Deploy comprehensive endpoint security solutions capable of detecting and preventing the execution of malicious code.​
• Incident Response Planning: Develop and regularly update incident response plans to address potential security breaches promptly and effectively.​

By staying vigilant and adopting proactive security measures, organizations can defend against sophisticated phishing campaigns like Storm-1865 and protect their sensitive information from cyber threats.​

The post Microsoft Alerts on New ‘ClickFix’ Phishing Scam Targeting Hospitality Industry via Booking.com appeared first on CyberHood Sentinel.

Exploiting AWS Misconfigurations

The attackers do not leverage inherent vulnerabilities within AWS itself. Instead, they capitalize on misconfigured AWS environments where access keys are inadvertently exposed. This lapse allows them to misuse services like Amazon Simple Email Service (SES) and WorkMail to dispatch phishing emails. By utilizing these legitimate AWS services, their malicious emails are more likely to bypass security filters, as they originate from trusted sources previously associated with the target organizations. ​

Attack Methodology

The group’s modus operandi involves obtaining exposed long-term access keys associated with Identity and Access Management (IAM) users. They gain initial access to AWS environments via the command-line interface (CLI). Between 2022 and 2024, they refined their tactics to include advanced defense evasion techniques aimed at obfuscating identities in CloudTrail logs, a tactic previously exploited by groups like Scattered Spider.

Once inside an organization’s AWS account, the attackers generate temporary credentials and a login URL to facilitate console access. This strategy allows them to obscure their identity and gain visibility into the AWS resources. Subsequently, they establish phishing infrastructure by creating new SES and WorkMail users and setting up new SMTP credentials to send email messages.

Persistence Mechanisms and Indicators

Throughout their campaigns, JavaGhost has been observed creating various IAM users, some of which are actively used during attacks, while others remain unused, seemingly serving as long-term persistence mechanisms. Notably, the group leaves a distinct marker by creating new Amazon Elastic Cloud Compute (EC2) security groups named “Java_Ghost,” with the description “We Are There But Not Visible.” These security groups do not contain any security rules, nor are they attached to any resources, but their creation is logged in CloudTrail, serving as a potential indicator of compromise.

Wider Implications

This incident underscores the critical importance of proper configuration and management of cloud services. Misconfigurations can lead to significant security breaches, as evidenced by previous incidents where attackers exploited AWS misconfigurations to steal vast amounts of sensitive data, including customer information, credentials, and proprietary source code. ​

Recommendations for AWS Users

To mitigate such risks, organizations utilizing AWS should adopt the following best practices:

• Secure Credential Management: Avoid hardcoding credentials in source code or configuration files. Instead, use AWS Secrets Manager or similar services to manage, retrieve, and rotate credentials securely.
• Regular Audits and Monitoring: Conduct periodic reviews of IAM users, roles, and policies. Implement monitoring to detect unusual activities, such as the creation of unexpected security groups or IAM users.​
• Least Privilege Principle: Ensure that IAM policies adhere to the principle of least privilege, granting users and services only the permissions necessary for their functions.​
• Incident Response Planning: Develop and regularly update incident response plans to address potential security breaches promptly and effectively

Conclusion

The exploitation of AWS misconfigurations by threat actors like JavaGhost highlights the necessity for vigilant cloud security practices. Organizations must proactively secure their cloud environments to prevent unauthorized access and safeguard their data and services from malicious activities.

The post Hackers Exploit AWS Misconfigurations to Launch Phishing Campaigns appeared first on CyberHood Sentinel.