PhishingPublished 17 Feb 2026

Fake Incident Report Used in Phishing Campaign, (Tue, Feb 17th)

Source SANS ISC Handlers Diary

Description

This morning, I received an interesting phishing email. I&&#x23;x26;&#x23;xe2;&&#x23;x26;&#x23;x80;&&#x23;x26;&#x23;x99;ve a &&#x23;x26;&#x23;xe2;&&#x23;x26;&#x23;x80;&&#x23;x26;&#x23;x9c;love &&#x23;x26; hate&&#x23;x26;&#x23;xe2;&&#x23;x26;&#x23;x80;&&#x23;x9d; relation with such emails because I always have the impression to lose time when reviewing them but sometimes it&&#x23;x26;&#x23;xe2;&&#x23;x26;&#x23;x80;&&#x23;x26;&#x23;x99;s a win because you spot interesting &&#x23;x26;&#x23;xe2;&&#x23;x26;&#x23;x80;&&#x23;x26;&#x23;x9c;TTPs&&#x23;x26;&#x23;xe2;&&#x23;x26;&#x23;x80;&&#x23;x9d; (&&#x23;x26;&#x23;xe2;&&#x23;x26;&#x23;x80;&&#x23;x26;&#x23;x9c;tools, techniques &&#x23;x26;&&#x23;xc2;&&#x23;xa0; procedures&&#x23;x26;&#x23;xe2;&&#x23;x26;&#x23;x80;&&#x23;x9d;). Maybe one day, I&&#x23;x26;&#x23;39;ll try to automate this process!

Impact

For European organizations, this phishing campaign poses a risk primarily to employees or customers who use MetaMask or similar cryptocurrency wallets. Successful phishing could lead to credential theft, unauthorized access to crypto wallets, and financial loss. Organizations involved in cryptocurrency trading, fintech, or blockchain services may face reputational damage and operational disruption if employees fall victim. The use of cloud-hosted phishing pages complicates detection and blocking, increasing the chance of successful attacks. Additionally, the campaign could serve as an initial access vector for broader attacks if compromised credentials are reused or if attackers leverage access to internal systems. The psychological impact of receiving a fake security incident report may increase user susceptibility, especially among less security-aware individuals. While no malware is involved, the potential for financial theft and account compromise is significant. European regulatory frameworks like GDPR may impose reporting obligations if personal data is compromised. The campaign’s medium sophistication level means it can evade some basic defenses but may be mitigated by user training and technical controls.

Defensive guidance

1. Implement advanced email filtering to detect and quarantine phishing emails, focusing on suspicious AWS-hosted URLs and attachments. 2. Educate users, especially those in finance and crypto-related roles, about phishing tactics involving fake incident reports and the importance of verifying email sender authenticity. 3. Encourage users to access MetaMask and other crypto services only through official apps or verified websites, avoiding links in unsolicited emails. 4. Deploy URL rewriting and sandboxing technologies to analyze links before users click them. 5. Monitor network traffic for connections to suspicious AWS S3 buckets or domains not associated with legitimate business operations. 6. Promote the use of hardware-based 2FA or multi-factor authentication methods that are resistant to phishing, rather than relying solely on app-based 2FA. 7. Regularly review and update incident response plans to include phishing scenarios targeting cryptocurrency users. 8. Use threat intelligence feeds to stay informed about emerging phishing campaigns targeting crypto wallets. 9. Encourage users to report suspicious emails promptly to security teams for analysis. 10. Consider deploying anti-phishing training simulations tailored to cryptocurrency-related phishing themes to increase user resilience.

Summary

This phishing campaign targets users of MetaMask, a widely used cryptocurrency wallet available as a browser extension and mobile app. The attackers send emails that include a PDF attachment titled “Security_Reports.pdf,” which contains a fabricated security incident report warning about unusual login activity. The PDF itself is not malicious but is crafted using ReportLab, a legitimate PDF generation library, to appear credible and induce fear. The email encourages recipients to enable two-factor authentication (2FA) by clicking a link hosted on an AWS S3 bucket URL (access-authority-2fa7abff0e.s3.us-east-1.amazonaws.com/index.html). This link likely leads to a phishing site designed to steal credentials or seed further compromise. The campaign’s technical sophistication is low: the sender address is not spoofed, and the PDF lacks personalization such as the recipient’s email or branding, which reduces its effectiveness. However, the use of a fake incident report as a social engineering lure is notable. The attackers exploit the victim’s concern about account security to trick them into visiting a malicious site. No malware or direct exploits are involved, and there are no known active exploits in the wild beyond the phishing attempt. The campaign leverages cloud infrastructure (AWS) to host phishing content, which may bypass some security filters. The threat was reported by a SANS ISC handler who analyzed the email and PDF, confirming the non-malicious nature of the attachment but highlighting the phishing intent. This campaign exemplifies the ongoing risk of phishing targeting cryptocurrency users, who are attractive targets due to the financial value of their accounts.

References

isc.sans.edu/diary/rss/32722 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Feb 2026, 10:00 UTC

References

Community reviews