Summary:
Threat actors are exploiting various digital document publishing platforms to conduct phishing, credential theft, and session token hijacking. Cisco Talos researchers highlighted this trend, noting that using DDP sites increases phishing success rates due to their positive reputation, absence from web filters, and familiarity to users.

Unlike previous methods using cloud service, attackers now turn to DDP servers for hosting phishing documents, aiming to bypass email security measures. These platforms allow PDF files to be shared as interactive flipbooks, offering animations and other effects. Adversaries exploit DDP’s free tiers or trial periods to create multiple accounts and share malicious content. Additionally, DDP sites automatically remove content after a set period, making it harder to trace. Productivity features like Publuu’s integration hinder link extraction and detection in phishing emails.

Analyst Comments:
In their attacks, threat actors embed links to DDP-hosted documents in emails, leading victims to fake Microsoft 365 login pages to steal credentials. Researchers warn that DDP sites pose a challenge to defenders as they are less known and evade email and web content filters, providing an advantage to attackers in phishing campaigns.

Suggested Corrections:
Researchers at Cisco Talos have published recommendations to defend against phishing attacks that leverage DDP sites: