Hackers Exploiting Popular Document Publishing Sites for Phishing Attacks

Cisco Talos observed threat actors leveraging digital document publishing (DDP) sites (FlipSnack, Issuu, Marq, Publuu, RelayTo, Simplebooklet) to host interactive phishing documents that serve as intermediaries to adversary-controlled pages; attackers exploit free/no-cost accounts, transient publishing, redirects and CAPTCHA solving to evade filters and ultimately harvest Microsoft 365 credentials and session tokens.