Example 169: View Sent Info

PDF "from" compromised U account with PDF linked to fake adobe doc login
Received November 2017

Things to note

• Attachment contains a PDF - only to deliver a link to a fake Adobe login
• Adobe login not *at* adobe.com
• "Logging in" to form presents Adobe error message, no document.

Message Text:

From: Xxxxx Xxxxxxxx < compromised user @umn.edu>Date: Tue, Nov 8, 2016 at 6:28 AMSubject: View Sent InfoTo: Xxxxx Xxxxxxxx < compromised user @umn.edu>
Good Morning,I need you to look through the included info and share your thoughts.

PDF with link to login form

oddly branded PDF with a link to a fake login page

Fake Login 

Fake (not hosted at adobe.com) Adobe login

"Error" message following login

"Error" message that kicks you out at the end (no document delivered)