# LinkedIn-Themed Phishing Abuses Adobe Target (A/B Testing) for Credential Theft

> A financially motivated phishing campaign impersonates LinkedIn business/contract inquiries and delivers double-extension HTML attachments (pdf.html) that render a fake LinkedIn login page with the victim's email pre-filled. Victim browsers are routed through Adobe's legitimate Adobe Target A/B-testing edge (lnkd.tt.omtrdc.net) to lend trust and track click-through, after which harvested credentials are exfiltrated to a PHP endpoint on a Russian SprintHost-hosted domain (a1263367.xsph.ru) and the victim is bounced to the real LinkedIn.

- **Published:** 2026-05-29T00:00:00Z
- **Last reviewed:** 2026-05-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0630
- **ID:** TL-2026-0630
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Researchers at Malwarebytes (2026-05-27), with corroboration from Help Net Security and TechNADU (2026-05-29), documented an active credential-theft phishing campaign that pairs classic brand impersonation with novel abuse of a legitimate enterprise marketing service. The lure is a short, professional business-inquiry email built around a signed-contract theme: the attacker claims to be a buyer who 'would like to do business with you via LinkedIn.' The spoofed sender uses a real company name and address but a fabricated employee identity, and the company location is frequently mismatched (non-US), which is one of the few reliable tells.

The email carries an HTML attachment that uses a deceptive double file extension (e.g. *.pdf.html) so that recipients believe they are opening a PDF contract. When opened in the browser, the file executes heavily obfuscated JavaScript. The payload is concealed using two layers of encoding: URL-encoding wrapping two Base64-encoded sections. Once decoded, the script renders a pixel-accurate fake LinkedIn login page with the victim's own email address hardcoded into the form and made non-editable, increasing perceived legitimacy and ensuring the harvested username matches the targeting list.

The campaign's distinguishing tradecraft is its use of Adobe Target, a legitimate A/B-testing and personalization platform within Adobe Experience Cloud, hosted on the omtrdc.net domain. The phishing flow sends the victim's browser through https://lnkd.tt.omtrdc.net/rest/v1/delivery (the Adobe Target delivery API; lnkd.tt.omtrdc.net resolves via CNAME to adobetarget.data.adobedc.net on Adobe-owned IP space). This 'living-off-trusted-sites' hop serves two purposes: network traffic appears to flow to a trusted Adobe address, evading reputation-based controls, and the A/B-testing telemetry lets the operator track exactly which recipients clicked through and reached the credential form. Adobe Target is not used to receive the stolen credentials — it is purely a trusted redirect and victim-tracking channel.

When the victim submits the form, the credentials are POSTed in the background to http://a1263367.xsph.ru/taam/Ln.php, where the parameter AA carries the hardcoded email and BB carries the user-entered password. The exfiltration host is a free subdomain on xsph.ru, the free virtual-hosting service operated by Russian provider SprintHost (AS35278), which has a documented history of hosting malware and phishing content (tracked by URLhaus and phish.report). Immediately after exfiltration the victim is redirected to the genuine business.linkedin.com to minimize suspicion and delay incident reporting. The operation is described as cheap and scalable, consistent with a commodity credential-harvesting crew rather than a tracked APT; the Russian hosting and free-tier infrastructure provide weak attribution signal only.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1566 Phishing
- T1204 User Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1684.001 Impersonation
- T1056 Input Capture
- T1102 Web Service
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service

## Sources

- [Fake LinkedIn emails abuse Adobe to track victims](https://www.malwarebytes.com/blog/threat-intel/2026/05/fake-linkedin-emails-abuse-adobe-to-track-victims)
- [LinkedIn-themed phishing abuses Adobe's A/B testing platform](https://www.helpnetsecurity.com/2026/05/29/linkedin-themed-phishing-adobe-a-b-testing-platform/)
- [Fake LinkedIn Collaboration Emails Abuse Adobe Target to Track Victims in Phishing Campaign](https://www.technadu.com/fake-linkedin-collaboration-emails-abuse-adobe-target-to-track-victims-in-phishing-campaign/628436/)
- [URLhaus — xsph.ru host abuse tracking (SprintHost free hosting)](https://urlhaus.abuse.ch/host/f0511508.xsph.ru/)
- [phish.report — Report phishing to SPRINTHOST, RU](https://phish.report/contacts/SPRINTHOST-RU)
- [AbuseIPDB — SPRINTHOST.RU 141.8.193.236](https://www.abuseipdb.com/check/141.8.193.236)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0630