Legitimate services can be exploited in social engineering, including business email compromise (BEC) attacks. Researchers at Check Point describe one current BEC campaign that’s using Soda PDF to send messages encouraging the recipients to call a phone number. Should they make the call, the bad actor on the line seeks to winkle them out of their cash.
Check Point calls these kinds of attempts, which “leverage legitimate services to send out malicious material,” BEC 3.0. In this case that legitimate service is Soda PDF, a tool that’s widely used for editing PDFs, signing them electronically, or converting them to other formats.
“It is,” Check Point says, “a trusted, legitimate service. And as we’ve seen so many times with BEC 3.0 attacks, legitimate services are ripe for exploitation. It provides hackers a way to latch on to the legitimate service and get into the inbox.”
This particular scam represents a two-step imposture. First, a message comes from Soda PDF representing itself as a legitimate document from a trusted source. It includes an invitation to call a number should the victim have questions.
The phone callis the second step: a human operator will ask for a credit card number. If the victim provides it, then the scammer has, and will place charges against the card. Even if the victim wises up and declines to provide a pay card, there’s still a risk, because the victim’s phone number will have been harvested. That in turn can be used to attempt further scams.
The language the scammers use may be at first glance unexceptional. “There’s nothing inherently off about the language since it comes from a legitimate source,” the report says. The authors suggest that, “One of the only ways to stop this attack is by scanning the page for phone numbers with AI. AI is able to scan the phone number to see if it’s legitimate or if it’s been associated with a scam.”
Of course, user education can also sensitize people to this kind of scam. Forewarned is forearmed, and new school security awareness training can help any organization resist BEC 3.0.
Avanan has the story.
CEO fraud has ruined the careers of many executives and loyal employees, causing over $26 billion in losses. Don’t be the next victim. This manual provides a thorough overview of how executives are compromised, how to prevent such an attack and what to do if you become a victim.
