The NJCCIC identified a phishing campaign that uses generic messaging to prompt recipients to act. The message does not identify the sender, the organization it purports to represent, or the purpose of the invitation. By keeping the content generic, attackers can distribute the same template to thousands of recipients without spending time customizing it.
The claim that the attachment "could not be included due to file size" is a common social engineering tactic. It offers a plausible pretext to direct recipients to an external link. Invoking a trusted brand, such as Adobe, can create a false sense of security, leading recipients to believe they are accessing a legitimate document-sharing platform.
The email specifically recommends accessing the link on a desktop or laptop computer. Malicious landing pages and fraudulent login portals are often designed to exploit browser vulnerabilities or steal credentials on desktop platforms. They may also be more convincing on larger screens.
The threat actors prompt the recipient to "follow any instructions or prompts displayed when opening the document" to trick the victim into granting suspicious browser permissions, providing account credentials (such as Microsoft 365 or Google login details), or executing malicious scripts disguised as software updates or security checks. While threat actors often try to scare their targets into taking action, phishing emails do not always rely on aggressive threats or a sense of urgency. Attackers sometimes use an overly formal, polite, and helpful tone to lower the recipient's defenses and make the request seem routine.
Recommendations
- Navigate directly to legitimate websites and verify before submitting account credentials, providing personal or financial information, or downloading files.
- Users who submitted credit card information to suspicious websites are advised to contact their banking institutions to report the fraudulent purchases.
- Enable multi-factor authentication (MFA) and keep systems and browsers up to date.
- If victimized, disconnect from the internet and run anti-virus/anti-malware scans.
- If sensitive information was entered, change passwords for compromised accounts, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources, including credit freezes.