New Phishing Attacks Stealing MFA Tokens Too

A trending phishing campaign targeting primarily German users distributes a malicious PDF attached to emails purporting to be an invoice. The PDF prompts victims to open it in Acrobat Reader, uses embedded JavaScript to collect Amazon usernames, passwords and 2FA tokens, and sends them in clear text to an attacker-controlled domain that mimics Amazon via a deceptive subdomain; sandbox testing and packet captures confirm credential and 2FA exfiltration, allowing attackers to access victim accounts and likely siphon funds.