According to recent research by Barracuda Networksthe leading provider of cloud-first security solutions, the Phishing attacks exploiting Adobe InDesignthe well-known publishing production program, are on the rise.
Adobe InDesign comes under attack from phishing emails
According to the telemetry data analyzed by Barracuda, in fact, from October to today the number of emails containing links to Adobe InDesign increased thirty-fold, from around 75 to around 2,000 episodes per day. Nearly one in ten emails (9%) contained active phishing links, while another approximately 20% included removed content.
Many of the phishing links observed by Barracuda researchers feature the prime domain “.ru” level and are hosted by a content delivery network that acts as a proxy for the originating site. This helps obscure the source of the content and makes attacks more difficult for security technologies to detect and block.
Attacks of all kinds, from the simplest to the most advanced that use Adobe InDesign
Some of the attacks they use Adobe InDesign they appear to be aimed at specific organizations or users. The emails contain real company logos, probably copied from other content or extracted from websites using scraping techniques. It is also likely that these logos were chosen because they were known and trusted by the victims, suggesting that the attackers spent time and resources creating these messages.
The remaining attacks mainly consist of generic, blanket messages containing the logos of OneDrive, SharePoint e Adobe. In particular, some emails feature rather basic texts, created without excessive creative effort.
Overall, it’s about relatively simple attacks and consistent in approach: the recipient is invited to click on a link that takes him to another site, hosted in the indd.adobe subdomain[.]com but actually controlled by criminals, who from here can move on to the next attack phase.
How to protect yourself
To avoid unpleasant surprises, it is important to adopt advanced, multi-layered and AI-supported email security solutions. therefore capable of detecting both emerging threats and the more well-known and widespread ones.
This must be combined with constant awareness raising among employees on the topic of IT security. In fact, training must be updated whenever new trends and types of threats appear, so that employees know what to pay attention to and how to act if they recognize a suspicious or malicious email.
In this regard, data collected by Barracuda shows that some of the Adobe InDesign-based phishing attacks have hit different employees in the same organization. In these cases, thanks to rapid reporting and response, it is possible to block attacks in their tracks.