Known malicious kitcriticalphishing
Fake 'Adobe PDF' e-mail sign-in page that sends the e-mail address and password to Telegram
family: adobe-pdf-telegram-login-kit-2026-11
Short link:scanmalware.com/h/334
A page styled as an Adobe PDF document asks the visitor to confirm their e-mail address and password to open a file. Each attempt is sent to the operator's Telegram bot, and the page answers 'Incorrect password' up to three times so the visitor types it again. Seen on free app-hosting subdomains, a cloud storage bucket and a folder inside a hacked WordPress site.
Anchors
Hunting ruleTelegram_PDF_Login_Attempt_Kit
SMQL queryrun
telegram_bot:8761944061 OR telegram_bot:8808624002 OR telegram_bot:8857675933 OR contacted_host:acrobat-pdf-download.vercel.app OR contacted_host:security-server--faifranhondyout.replit.appProvenance
Added: 2026-11-01 09:59
Matches the page's own code (its Telegram submit and its retry logic) wherever it is served, plus the operators' Telegram bots and two known hosts.
Sightings (18)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| acrobat-pdf-download.vercel.app | 3068506a… | — | query | 2026-11-01 13:50 |
| www.acrobat-pdf-download.vercel.app | 3068506a… | https://www.acrobat-pdf-download.vercel.app/#html | rule | 2026-11-01 13:50 |
| acrobat-pdf-download.vercel.app | 3068506a… | https://acrobat-pdf-download.vercel.app/ | rule | 2026-11-01 13:50 |
| acrobat-pdf-download.vercel.app | 7370e37a… | — | query | 2026-11-01 13:45 |
| www.acrobat-pdf-download.vercel.app | 7370e37a… | https://www.acrobat-pdf-download.vercel.app/#html | rule | 2026-11-01 13:45 |
| acrobat-pdf-download.vercel.app | 7370e37a… | https://acrobat-pdf-download.vercel.app/ | rule | 2026-11-01 13:45 |
| security-server--faifranhondyout.replit.app | a80ac91e… | — | query | 2026-11-01 09:50 |
| acrobat-pdf-download.vercel.app | cd4abaef… | https://acrobat-pdf-download.vercel.app/#html | rule | 2026-11-01 00:45 |
| acrobat-pdf-download.vercel.app | cd4abaef… | — | query | 2026-11-01 00:45 |
| security-server--faifranhondyout.replit.app | dd8a19f3… | https://security-server--faifranhondyout.replit.app/#html | rule | 2026-10-25 08:50 |
| security-server--faifranhondyout.replit.app | dd8a19f3… | — | query | 2026-10-25 08:50 |
| security-server--faifranhondyout.replit.app | 7abe710e… | https://security-server--faifranhondyout.replit.app/#html | rule | 2026-10-25 05:04 |
| security-server--faifranhondyout.replit.app | 7abe710e… | — | query | 2026-10-25 05:04 |
| s3.us-east-1.amazonaws.com | 73144fb2… | https://s3.us-east-1.amazonaws.com/fidelitysecure-achieve-storage/adobevn.html#html | rule | 2026-10-08 12:45 |
| s3.us-east-1.amazonaws.com | 73144fb2… | — | query | 2026-10-08 12:45 |
| ingeko-energies.fr | 430abaf1… | https://ingeko-energies.fr/wp-content/plugins/ojypkws/online.html#html | rule | 2026-09-04 16:50 |
| ingeko-energies.fr | 5eac6aaf… | https://ingeko-energies.fr/wp-content/plugins/ojypkws/online.html#html | rule | 2026-08-28 15:50 |
| ingeko-energies.fr | 777f97d3… | https://ingeko-energies.fr/wp-content/plugins/ojypkws/online.html#html | rule | 2026-08-21 14:50 |