Check Point Research flagged a Foxit PDF Reader vulnerability being exploited to trigger security warnings that may mislead users into running harmful commands. WhoisXML API expanded the IoCs trail, revealing a large network of domains and IPs linked to phishing and malware activities. #FoxitPDFReader #Phishing
Keypoints
- The Foxit PDF Reader vulnerability can deceive users into executing harmful commands when security warnings are triggered.
- WhoisXML API expanded the public IoCs list by analyzing eight domains and one IP, uncovering 55 registrant-connected domains (two malicious), one email-connected domain, eight additional IPs (six malicious), and 44 string-connected domains.
- Phishing-related activity was identified, with two registrant-connected domains (contracsupport.click and facebook-helper.click) explicitly associated with phishing.
- Brand impersonation appeared in registrant-connected domains (e.g., facebook-helper.click for Facebook; grammasly.com/grammasly.xyz for Grammarly; metabusiness.mom for Meta).
- DNS lookups linked IoCs to eight IP addresses; example threats included generic malware and phishing (e.g., 104.21.36.187; 172.67.134.54).
- Threat actors used old and new domains (2018–2024) and spread artifacts across multiple countries and ISPs, with Cloudflare serving as a major ISP for several IPs.
- In total, 108 potentially connected digital properties were identified (55 registrant-connected domains, 1 email-connected domain, 8 additional IPs, 44 string-connected domains), with eight artifacts tied to C2, malware distribution, and phishing.
MITRE Techniques
- [T1203] Exploitation for Client Execution – The bug triggers security warnings that may deceive unsuspecting users into executing harmful commands. ‘The bug triggers security warnings that may deceive unsuspecting users into executing harmful commands.’
- [T1566.002] Phishing – Two registrant-connected domains were associated with phishing. ‘two—contracsupport[.]click and facebook-helper[.]click—were associated with phishing.’
Indicators of Compromise
- [Domain] domain names – omagle-chat-secure[.]com, facebook-helper[.]click (examples of registrant-connected and phishing-related domains)
- [IP] IP addresses – 104[.]21[.]36[.]187, 172[.]67[.]134[.]54 (threats including generic malware and phishing)
Read more: https://circleid.com/posts/20240613-on-the-dns-trail-of-the-foxit-pdf-bug-exploitation-attackers