Researchers have recently observed actors taking advantage of the legitimate e-signature service Adobe Acrobat Sign to distribute info-stealing malware. The campaign operators register for the service and send targeted emails containing documents hosted on Adobe’s servers. The emails involve a real Adobe email address and legitimate Adobe URL to trick users into opening the shared documents and clicking a link contained in the documents’ text. The link redirects users to a different website that prompts for a hard coded CAPTCHA to be entered. Once the CAPTCHA is completed, the users are prompted to download a malicious ZIP file that contains one (1) of two (2) possible “Redline” trojan variants, which have capabilities to exfiltrate passwords, cryptocurrency wallets, and more from a victim device. Researchers noted that the campaign operators “artificially increased the size of the Trojan to more than 400MB”, which is suspected to be due to bypassing antivirus engines that behave differently for large files. Currently, it appears this technique is targeted to a specific victim, but there is a chance that it could be picked up by additional actors and see more widespread usage in the future. CTIX analysts recommend users to be cautious of all files they are emailed and ensure their legitimacy prior to interacting.