A newly documented phishing campaign is targeting professionals with fake LinkedIn business emails and abusing a trusted service operated by Adobe. The attack, which has been observed by security researchers, leverages multiple layers of deception to make the phishing attempt appear legitimate and evade detection by email security solutions. By exploiting Adobe's A/B testing platform, the attackers are able to route traffic through a trusted domain, making the network activity appear normal while simultaneously tracking which victims interact with the malicious payload.
The Attack from the Victim's Perspective
The attack begins with an email that, at first glance, looks like a routine business inquiry. The subject line suggests that someone wants to do business with the recipient through LinkedIn and has attached a signed contract for review. The message is short and professional, and the sender company and name appear to exist. However, if the potential victim investigates further, they may discover that the sender does not actually work for the claimed company, a common red flag that many busy professionals might overlook.
Those who open the attachment are presented with a familiar-looking LinkedIn login page, with their email address already filled in. This personalization is achieved by extracting the recipient's email from the targeting data and embedding it in the HTML form. If the user types their password and hits submit, their credentials are sent to a server operated by the attackers, and they are then redirected to the real LinkedIn website. This redirection adds a layer of authenticity, as the user sees the legitimate LinkedIn interface after entering their information, which may cause them to assume their login succeeded normally.
The phishing email and the fake login page are carefully designed to mimic the look and feel of LinkedIn's official communications. The use of a signed contract as the lure is particularly effective because professionals frequently receive such documents through business networks. The attackers also take advantage of the fact that many users are accustomed to opening attachments from unknown senders in a business context, especially when the communication appears to be related to a potential partnership or job opportunity.
The Tricks Behind the Attack
The attackers employed several layers of deception to make this attack effective and difficult to detect. First, they disguise the attached HTML file as a PDF by using double extensions, such as filename.pdf.html. Many operating systems and email clients hide the last extension by default, so users only see the .pdf part and assume it is a safe document. Second, the HTML file itself is heavily obfuscated, using encoded strings and JavaScript to construct the fake login form dynamically. This obfuscation makes it harder for automated scanners to identify the malicious intent.
The email field in the fake login form is pre-filled with the target's email address, making the page feel personalized and trustworthy. This technique is known as pre-population, and it is often used in legitimate services to streamline the user experience. By leveraging the recipient's email, the attackers reduce the likelihood that the user will question the authenticity of the page. The attacker likely obtains the email addresses from previous data breaches or publicly available sources such as LinkedIn profiles themselves.
Perhaps the most sophisticated aspect of the attack is the abuse of Adobe's infrastructure. Rather than directing the victim directly to their own servers, the attackers send the browser through Adobe Target, a legitimate A/B testing platform hosted at the omtrdc.net domain. Adobe Target is widely used by marketing teams to test different versions of web pages. The attackers have either compromised an Adobe Target account or discovered a way to use the platform's redirect functionality for malicious purposes. This serves two purposes: it makes the network traffic look like it is going to a trusted Adobe address, and it likely allows the attackers to track which victims actually clicked through and submitted their credentials. By using a legitimate platform, the attackers also reduce the chance that the domain will be blocklisted by security vendors, as Adobe's infrastructure is known and trusted.
Phishing at Scale
These types of attacks are built to scale. The attackers can generate thousands of personalized emails at low cost, using automated tools to harvest email addresses and craft the phishing pages. The use of Adobe Target means that even if security teams block the initial domain, the attackers can quickly spin up new campaigns using different route settings within the same platform. Researchers from Malwarebytes, who documented this campaign, noted that the attack vectors are cheap, scalable, and likely to circulate for an extended period. They also highlighted that phishing campaigns targeting LinkedIn credentials have been on the rise in recent years, as the platform holds valuable professional data that can be used for social engineering, financial fraud, or corporate espionage.
The phishing campaign is not limited to any particular industry or geographic region. Because LinkedIn is used globally by professionals across sectors, the attackers can cast a wide net. The email messages are written in perfect English, suggesting that the attackers may be native speakers or have employed professional translators. The social engineering is carefully crafted to avoid common spam indicators, such as misspellings or generic greetings, which further increases the likelihood that the email will reach the inbox and be opened.
How to Protect Against These Attacks
Careful users should be able to spot the phishing warning signs. The email may have a slightly mismatched sender name, unusual phrasing in the body, or an attachment that requests a login action. However, a moment of distraction is sometimes enough to fall victim. To stay safe, users should avoid opening unsolicited attachments, especially those that prompt for login credentials. Instead, they should navigate directly to the official LinkedIn website by typing the URL into their browser or using a trusted bookmark. Enabling multi-factor authentication (MFA) is one of the most effective ways to protect against credential theft, as even if the password is compromised, the attacker cannot log in without the second factor.
Organizations should also deploy advanced email security solutions that can analyze attachments in a sandbox environment and detect obfuscated HTML files. Security awareness training should include examples of sophisticated phishing campaigns that abuse trusted platforms, as many users are unaware that services like Adobe Target can be misused. Furthermore, IT administrators should consider blocking or restricting access to known A/B testing domains unless explicitly required for business purposes, though this can be challenging because these domains are used for legitimate activities.
Another layer of defense is the use of browser-based password managers that do not auto-fill credentials on unknown domains. If the password manager does not recognize the fake LinkedIn page, it will not offer to fill in the saved credentials, alerting the user that something is amiss. Additionally, users can inspect the SSL certificate of any login page; legitimate LinkedIn pages use a certificate issued to LinkedIn Corporation, while phishing pages often use self-signed or low-cost certificates that do not match the expected organization.
As the threat landscape evolves, attackers continue to find new ways to exploit trust. The abuse of Adobe's platform is a prime example of how cybercriminals leverage legitimate services to bypass security controls. This trend, known as "living off the land," allows attackers to blend in with normal network traffic and evade detection by traditional signature-based tools. The same technique has been observed with other cloud services, such as Google Drive, Microsoft Azure, and Amazon Web Services, which are often used for hosting phishing pages or command-and-control infrastructure.
In conclusion, the LinkedIn-themed phishing campaign that abuses Adobe's A/B testing platform highlights the importance of constant vigilance and layered security measures. By understanding the technical details of this attack and implementing the recommended protections, professionals and organizations can reduce their risk of falling victim to credential theft. The campaign serves as a reminder that even trusted brands and services can be turned against users, and that security must be built into every layer of the digital ecosystem.
Source:Help Net Security News