Generic email credentials phishing (2022-06-02)


The threat actor leverages a fake PDF document download theme, to acquire email login credentials.


In this phishing attempt, the threat actor sends an email saying that a PDF file is available to be downloaded. The phishing link (hxxps://sfo3[.]digitaloceanspaces[.]com/omdshudhuw0dgw201sei0/%21%24.o.m.%26%26%21/>) makes use of the recipient email address to fill the phishing form.

The phishing page detects the domain of the recipient’s email address, and adapts the logo accordingly on the left top-corner. For demonstration purposes, we used

A fake Symantec verification (yellow logo) is also shown to easier acquire the trust of a potential victim. No actual PDF file is available to be downloaded and the threat is limited to phishing only.


phishing_email fake_document fake_login_form


If you are uncertain about the authenticity of an email, do not hesitate to contact the entity that seems to have sent you the email using a safe communication manner, using the phone for example (no phone number from the untrusted email must be used in order to verify the authenticity).
If you are working for the Luxembourgish government or are using any of the GOVCERT.LU services, it is important to forward phishing emails to us (using Reporting an incident or the Outlook button). This will allow us to take down phishing websites and protect members of our constituency.

Report an incident

If you wish to report an incident anonymously, please complete the PGP encrypted reporting form.

> Report
> More Information