Log in Request a demo

Security News

Adobe Acrobat Sign Abused in Redline Stealer Distribution Campaigns

How threat actors abuse Adobe Acrobat Sign signing requests to deliver Redline Stealer, how the lure reaches users, and what to do to stay safe.

Updated 3 Min Read

Adobe Acrobat Sign is a cloud service for signing documents online, and the post describes how threat actors abused it in a campaign that spread Redline Stealer. The attackers sent real signature request emails through Adobe’s own service. The linked document led victims to a CAPTCHA page and a ZIP file holding a Redline variant that steals passwords and crypto wallets.

Public reporting shows that the Adobe Acrobat Sign software is being manipulated in Redline Stealer distribution campaigns by threat actors. Adobe Acrobat Sign is a cloud service offered by Adobe that allows users to sign documents online right after registering. Adobe Acrobat Sign allows registered users to send document signing requests to anyone. This will create an email that will be sent to the targeted recipients containing a link to the document (PDF, Word document, HTML) that will be hosted on Adobe’s servers. The sender can also add text to the email, which is an important detail that can be easily exploited by cybercriminals.

How Is Adobe Acrobat Sign Abused to Spread Redline Stealer?

The observed malicious software campaign starts with threat actors sending a signature request email to recipients through the genuine Adobe Acrobat Sign service. The email links to a page hosted at “eu1.documents.adobe.com/public/”, which is a legitimate Adobe resource. Users of this service can upload various file types to Adobe Acrobat Sign that will be displayed in the email along with the signing option. Threat actors add a link to the fake document that recipients are expected to sign, which allows them to review the content before signing. When recipients click on the link, they are redirected to another site where they are asked to solve a CAPTCHA. Once the CAPTCHA is solved, they are prompted to download a ZIP file containing a Redline Trojan variant designed to steal passwords, crypto wallets, and more.
How the Adobe Acrobat Sign lure runs
  1. Signature request emailSent through the genuine Adobe Acrobat Sign service
  2. Open the documentOpens a page on eu1.documents.adobe.com/public/
  3. Link in the fake documentLeads to another site that asks for a CAPTCHA
  4. ZIP downloadHolds a Redline variant that steals passwords and crypto wallets

How Can You Protect Against This Redline Campaign?

  • Emails, attachments, and links from unknown sources should not be trusted or clicked.
  • Comprehensive and reliable security solutions should be used, and the IoCs (indicators of compromise) identified in the relevant campaign should be blocked by these security solutions.

About Redline Stealer

Redline is an information stealer first identified in 2020 and sold as Malware as a Service, as described on the MITRE ATT&CK page for RedLine Stealer. It steals browser credentials, cryptocurrency wallet data and other information from infected systems.
Redline Stealer at a glance
Type
Information stealer sold as Malware as a Service
First identified
2020
Steals
Passwords, crypto wallets and more
What happens to the data
Sold to initial access brokers, who use or resell it
In this context, it is recommended to consider the following security warnings to avoid being the target of malware campaigns that can be carried out with similar methods.

Frequently Asked Questions.

How do attackers abuse Adobe Acrobat Sign to spread Redline Stealer?

They use the service to send a signature request email that looks real. The document holds a link to another site with a CAPTCHA, and that site offers a ZIP file with a Redline variant.

Is the Adobe Acrobat Sign email fake?

No, the signature request is sent through the genuine Adobe service and the first page is hosted by Adobe. The harmful link is placed inside the document the attacker uploads.

What does Redline Stealer do?

It is an information stealer first identified in 2020 and sold as Malware as a Service. It takes saved credentials from browsers and other apps, and can take crypto wallet data.

How can I avoid this kind of attack?

Do not click links or attachments from unknown senders. If a message looks suspicious, delete it and report it to your email provider instead of replying.

Sources

  1. 1 MITRE ATT&CK: RedLine Stealer (S1240)
  2. 2 BleepingComputer: Adobe Acrobat Sign abused to push Redline info-stealing malware
Share

In This Article

Malware and toolsRedLine Stealer TermsThreat actor TermsTrojan TermsIndicator of compromise (IoC) TermsInfostealer TermsMalware-as-a-service (MaaS) TermsMITRE ATT&CK TermsInitial access broker

Where To Next.

All Security News Articles
In plain words · Glossary term Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Open → Keep reading · Article Threat Actors Behind GoAnywhere Attacks Target Hitachi Energy

Hitachi Energy confirmed a data breach after Cl0p exploited the GoAnywhere MFT zero-day CVE-2023-0669.

Open → Keep reading · Article A New Malware Campaign Detected through Microsoft OneNote Files

OneNote malware campaigns hide malicious files under fake buttons in .one attachments.

Open →

Knowledge HubMalware and tools