Phishing Campaign Baits Hook With Malicious Amazon PDFs

Researchers at Palo Alto Networks Unit42 discovered a phishing campaign distributing 31 PDF attachments that link to Amazon-impersonation pages hosted on redirect service subdomains (duckdns.org and redirectme.net). Victims who click the PDF links are redirected through staging URLs to cloaked phishing sites that solicit personal and credit card details; the campaign uses cloaking to evade automated scans and analysis.