MetaMask Users Targeted with Phishing Emails Containing Forged Security Report to Evade Detection

A new phishing campaign is targeting MetaMask users through carefully crafted emails that contain fake security incident reports designed to manipulate victims into compromising their accounts.

The attack leverages social engineering tactics by creating a false sense of urgency around account security, specifically pushing users to enable two-factor authentication through malicious links.

MetaMask, a widely used cryptocurrency wallet available as both a browser extension and mobile application, has become a prime target for attackers seeking to exploit its large user base.

The phishing emails arrive with an attached PDF file named “Security_Reports.pdf” that contains a fabricated security incident report warning recipients about unusual login activity on their accounts.

This document is not malicious itself but serves as a psychological weapon to alarm users and lower their defenses.

The emails also include a link directing victims to an AWS-hosted phishing page located at hxxps://access-authority-2fa7abff0e.s3.us-east-1.amazonaws.com/index.html, where the actual credential theft occurs.

Internet Storm Center analysts identified this campaign and noted several interesting technical details about its execution.

The fake PDF was generated using ReportLab, a legitimate online service and Python library commonly used for creating professional-looking PDF documents.

The PDF file carries the SHA256 hash 2486253ddc186e9f4a0616707 65ad0730c8945164a3fc83d7b22963950d6dcd1, allowing security teams to identify copies of the malicious document.

Despite the sophisticated use of forged security reports, researchers noted that the overall campaign quality remains relatively low.

The sender addresses are not spoofed, making it easier to identify the emails as fraudulent upon closer inspection.

Additionally, the PDF documents lack personalization or branding specific to individual victims, which could have made the attack more convincing.

Phishing Mechanism and Social Engineering Tactics

The attack operates by exploiting users’ natural concern for account security and fear of unauthorized access.

The forged incident report creates an artificial emergency situation that pressures recipients into taking immediate action without carefully verifying the authenticity of the communication.

By framing the phishing link as a security enhancement measure, attackers attempt to bypass users’ natural skepticism about clicking suspicious links.

The use of Amazon Web Services infrastructure for hosting the phishing page adds an additional layer of perceived legitimacy, as AWS domains may appear more trustworthy to less technically savvy users.

Users should verify the sender’s email address carefully before opening attachments or clicking links in security-related messages.

MetaMask never requests sensitive information such as recovery phrases through email communications. Enable two-factor authentication only through official MetaMask channels accessed by manually typing the website address.

Security teams should block the identified AWS phishing domain and add the PDF hash to threat intelligence databases.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post MetaMask Users Targeted with Phishing Emails Containing Forged Security Report to Evade Detection appeared first on Cyber Security News.