{"id":10726,"date":"2026-02-18T04:03:37","date_gmt":"2026-02-18T04:03:37","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/18\/32722\/"},"modified":"2026-02-18T04:03:37","modified_gmt":"2026-02-18T04:03:37","slug":"32722","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/18\/32722\/","title":{"rendered":"Fake Incident Report Used in Phishing Campaign, (Tue, Feb 17th)"},"content":{"rendered":"

Fake Incident Report Used in Phishing Campaign, (Tue, Feb 17th)
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

This morning, I received an interesting phishing email. I\u2019ve a \u201clove & hate\u201d relation with such emails because I always have the impression to lose time when reviewing them but sometimes it\u2019s a win because you spot interesting \u201cTTPs\u201d (\u201ctools, techniques &\u00a0 procedures\u201d). Maybe one day, I’ll try to automate this process!<\/p>\n

Today’s\u00a0email targets Metamask[1<\/a>] users. It\u2019s a popular software crypto wallet available as a browser extension and mobile app. The mail asks the victim to enable 2FA:<\/p>\n

\"\"<\/p>\n

The link points to an AWS server:\u00a0hxxps:\/\/access-authority-2fa7abff0e[.]s3.us-east-1[.]amazonaws[.]com\/index.html<\/p>\n

But it you look carefully at the screenshots, you see that there is a file attached to the message: \u201cSecurity_Reports.pdf\u201d. It contains a fake security incident report about an unusual login activity:<\/p>\n

\"\"<\/p>\n

The goal is simple: To make the victim scary and ready to \u201cincrease\u201d his\/her security by enabled 2FA.<\/p>\n

I had a look at the PDF content. It\u2019s not malicious. Interesting, it has been generated through ReportLab[2<\/a>], an online service that allows you to create nice PDF documents!<\/p>\n

\n6 0 obj\n<<\n\/Author ((anonymous)) \/CreationDate (D:20260211234209+00'00') \/Creator ((unspecified)) \/Keywords () \/ModDate (D:20260211234209+00'00') \/Producer (ReportLab PDF Library - www.reportlab.com)\n  \/Subject ((unspecified)) \/Title ((anonymous)) \/Trapped \/False\n>>\nendobj<\/pre>\n
They also provide a Python library to create documents:<\/p>\n
\npip install reportlab<\/pre>\n
The PDF file is the SHA256 hash\u00a02486253ddc186e9f4a061670765ad0730c8945164a3fc83d7b22963950d6dcd1.<\/p>\n
Besides the idea to use a fake incident report, this campaign remains at a low quality level because the “From” is not spoofed, the PDF is not “branded” with at least the victim’s email. If you can automate the creation of a PDF file, why not customize it?<\/p>\n
[1] https:\/\/metamask.io<\/a>
\n\u200b\u200b\u200b\u200b\u200b\u200b\u200b[2] http:\/\/www.reportlab.com<\/a><\/p>\n
Xavier Mertens (@xme)
\nXameco
\nSenior ISC Handler – Freelance Cyber Security Consultant
\nPGP Key<\/a><\/p>\n
 (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n
 \t

\n 
<\/BR><\/p>\n
 \t

\n
<\/BR>
\nGo to isc.sans.edu<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Fake Incident Report Used in Phishing Campaign, (Tue, Feb 17th) This morning, I received an interesting phishing email. I\u2019ve a \u201clove & hate\u201d relation with such emails because I always have the impression to lose time when reviewing them but sometimes it\u2019s a win because you spot interesting \u201cTTPs\u201d (\u201ctools, techniques &\u00a0 procedures\u201d). Maybe one […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-10726","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10726"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10726"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10726\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}