From Attachments to SEO: Click Here to Learn More about Clickbait PDFs!

Stivala, Giada and Abdelnabi, Sahar and Mengascini, Andrea and Graziano, Mariano and Fritz, Mario and Pellegrino, Giancarlo

(2023) From Attachments to SEO: Click Here to Learn More about Clickbait PDFs!

In: ACSAC '23: Proceedings of the 38th Annual Computer Security Applications Conference, 4-8 December 2023, Austin, TX.

Conference: ACSAC Annual Computer Security Applications Conference

(In Press)

This is the latest version of this item.

Text
Revised.pdf
Download (1MB)

Abstract

Clickbait PDFs are PDF documents that do not embed malware but trick victims into visiting malicious web pages leading to attacks like password theft or drive-by download. While recent reports indicate a surge of clickbait PDFs, prior works have largely neglected this new threat, considering PDFs only as accessories of email phishing campaigns. This paper investigates the landscape of clickbait PDFs and presents the first systematic and comprehensive study of this phenomenon. Starting from a real-world dataset, we identify 44 clickbait PDF clusters via clustering and characterize them by looking at their volumetric, temporal, and visual features. Among these, we identify three large clusters covering 89% of the dataset, exhibiting significantly different volumetric and temporal properties compared to classical email phishing, and relying on web UI elements as visual baits. Finally, we look at the distribution vectors and show that clickbait PDFs are not only distributed via attachments but also via Search Engine Optimization attacks, placing clickbait PDFs outside the email distribution ecosystem. Clickbait PDFs seem to be a lurking threat, not subjected to any form of content-based filtering or detection: AV scoring systems, like VirusTotal, rank them considerably low, creating a blind spot for organizations. While URL blocklists can help to prevent victims from visiting the attack web pages, we observe that they have a limited coverage.

Item Type:	Conference or Workshop Item (A Paper) (Paper)
Divisions:	Giancarlo Pellegrino (GP)
Conference:	ACSAC Annual Computer Security Applications Conference
Depositing User:	Giada Martina Stivala
Date Deposited:	20 Nov 2023 13:52
Last Modified:	22 Dec 2023 10:37
Primary Research Area:	NRA5: Empirical & Behavioral Security
URI:	https://publications.cispa.saarland/id/eprint/4052

Available Versions of this Item

From Attachments to SEO: Click Here to Learn More about Clickbait PDFs! (deposited 20 Nov 2023 13:52) [Currently Displayed]

Actions

Actions (login required)

View Item