Threat actors leverage document publishing sites for ongoing credential and session token theft
Summary: Cisco Talos reported responding to several incidents where threat actors hosted phishing documents on legitimate digital document publishing sites such as Publuu and Marq to harvest credentials and session tokens. The attacks often ran through a compromised third-party email inbox, with lures customized per target and pages sometimes launched and disabled in under 24 hours.
Bottom line: These DDP sites carry favorable reputation scores and are unlikely to be flagged by email and web filtering, so a lure can live and disappear inside a day while your defenders are still working out what it was.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026