DOUBLOON DREDGER Notion-lure PDF with redundant malicious links
Detects PDF documents that impersonate Notion invitation notifications and incorporate multiple redundant/overlapping URI links. This technique is used by the threat actor DOUBLOON DREDGER to facilitate EvilTokens device code harvesting campaigns.
YARA
