CampaignPublished 2 Feb 2026

Fake Dropbox Phishing Campaign via PDF and Cloud Storage

Source AlienVault OTX General

Description

A sophisticated phishing campaign has been detected that utilizes a multi-stage approach to evade detection. The attack begins with a procurement-themed email containing a PDF attachment. This PDF redirects victims to another PDF hosted on trusted cloud storage, which then leads to a fake Dropbox login page. The attackers exploit trusted platforms and harmless file formats to bypass security measures. The campaign uses social engineering tactics to harvest credentials, which are then exfiltrated to attacker-controlled infrastructure via Telegram. This method proves effective by leveraging legitimate business processes, trusted file types, and reputable cloud services to appear authentic and bypass automated security checks.

Impact

For European organizations, the primary impact is credential theft leading to unauthorized access to Dropbox accounts and potentially other linked corporate resources. Compromised credentials can enable attackers to access sensitive corporate data stored in Dropbox, disrupt business operations, or facilitate further lateral movement within the organization’s network. The use of trusted cloud storage and PDF files lowers suspicion, increasing the risk of successful phishing. Exfiltration via Telegram complicates detection and response efforts. Organizations with procurement or supply chain functions are particularly vulnerable due to the theme of the phishing email. Loss of credentials can lead to data breaches, regulatory non-compliance (e.g., GDPR violations), reputational damage, and financial loss. The campaign’s medium severity reflects the moderate but tangible risk posed by credential compromise and subsequent misuse.

Defensive guidance

1. Implement advanced email filtering solutions that analyze multi-stage redirections and inspect PDF attachments for embedded URLs or suspicious content. 2. Conduct targeted phishing awareness training emphasizing the risks of opening unsolicited procurement-related attachments and verifying URLs before entering credentials. 3. Enforce multi-factor authentication (MFA) on Dropbox and other cloud services to reduce the impact of stolen credentials. 4. Monitor network traffic for unusual outbound connections to Telegram API endpoints or other uncommon exfiltration channels. 5. Use domain and URL reputation services to block access to known malicious domains such as the identified vercel-storage.com subdomain and suspicious URLs. 6. Employ endpoint detection and response (EDR) tools to detect suspicious PDF behaviors and script execution. 7. Regularly audit and review access logs for Dropbox and cloud services to identify anomalous login attempts or geographic irregularities. 8. Encourage users to report suspicious emails and provide clear procedures for verification of procurement requests. 9. Collaborate with cloud service providers to report and take down malicious hosted content promptly. 10. Maintain updated threat intelligence feeds to stay informed about emerging phishing campaigns and indicators of compromise.

Indicators of compromise

Domains 1

nte2srryro7jecki.public.blob.vercel-storage.com

URLs 2

http://nte2srryro7jecki.public.blob.vercel-storage.com/ProductLists.pdf
http://tovz.life/bid-doc2026.php/?ai=xdC2https[://]api.telegram.org/bot6141034733:AAH-FLm9XyFjiV6F7jq6UHBXcVZTq7rZbP0/sendMessage

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Feb 2026, 20:29 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 1

URLs 2

Community reviews

Related threats