This is where the intent is revealed, which is to gain access to the user's Microsoft credentials. In the second step, the landing page contains an O365 image with a button to “Access Document”. First, the recipient must click the link provided in the email, which leads to a standard Dropbox transfer landing page with the enablement to download the file.Īfter clicking on the download button, the page is redirected to a phishing landing page. The body contains a link to the file “COVID-19-Relief-Payment.PDF” with information about the size of the file, a brief description of the file, and the expiration date. The email itself is an automated message from the sender “ which is an official Dropbox domain. In this attack, threat actors use a Dropbox link and landing page to do so. Since applicants are expecting email correspondence, this provides attackers with a unique opportunity to impersonate legitimate authorities and extract sensitive information from customers. This allows attackers to exploit current efforts by the government, particularly since applicants to these funds typically have to provide documents to prove their eligibility. As the COVID-19 pandemic continues, governments worldwide are providing relief funds for small business owners impacted by lockdowns and closures.

Cancel dropbox transfer