Hackread: 'Phantom Preview' campaign abuses Frame.io share emails to steal Microsoft 365 logins via msauth.biz
Hackread reported on 20 October 2026 on research by Ocean Security into a campaign it calls 'Phantom Preview', in which attackers abused legitimate Frame.io file-sharing notifications, sent from Frame.io's genuine add…
- First reported
- Reports
- 1
Source: hackread.com · published
What happened
Hackread reported on 20 October 2026 on research by Ocean Security into a campaign it calls 'Phantom Preview', in which attackers abused legitimate Frame.io file-sharing notifications, sent from Frame.io's genuine address, to deliver a PDF containing a hidden link. The link led through a Cloudflare Pages redirect to msauth.biz, a domain registered via eNom on 6 August 2026 and hosted on DigitalOcean, which reportedly had 0/91 detections on VirusTotal. The site used a Cloudflare Turnstile CAPTCHA and token-based URLs before showing a fake Microsoft 365 login page designed to capture credentials in an adversary-in-the-middle attack. According to the report, 22 emails were sent to a single organisation within two hours and the campaign was detected on 27 August 2026. Frame.io itself was not compromised; its notifications were misused, and Microsoft is not involved.
How the scam works
Hackread says the messages came from Frame.io's genuine notification address with the subject line "Jason Pitts shared 'BTF Project' with you", so they looked like routine file-sharing alerts. The first link led to Frame.io's real platform, where the shared PDF appeared only as a non-clickable preview. That kept the malicious destination hidden from scanners checking the share page, and conventional security checks did not flag it, although an employee reported the first email three minutes after it arrived.
Ocean Security retrieved the original PDF and found a link hidden in the document's link annotations. It redirected through a Cloudflare Pages address to msauth.biz. A Cloudflare Turnstile CAPTCHA made the page harder for automated tools to inspect; after a visitor passed it, JavaScript built a URL containing a unique token that led to the fake Microsoft 365 login page. Ocean Security says the token was meant to stop the link being easily shared or reused, keeping the page tied to its intended target. In an adversary-in-the-middle attack, the page passes what the victim types to the real service, which can let attackers capture a session as well as a password.
Ocean Security recommends checking the files behind share notifications, not just the sender or the link, including PDFs that hide links to newly registered domains or unfamiliar Cloudflare Pages addresses.
Source
Hackread, "Scammers Abuse Frame.io to Steal Microsoft 365 Credentials" (published 20 October 2026).
Red flags
- A file-share notification for a project you weren't expecting.
- A shared PDF that sends you to a Microsoft 365 sign-in page.
- A CAPTCHA before a login page.
- A sign-in page whose address isn't a Microsoft domain such as login.microsoftonline.com.
- Several similar share emails arriving across an organisation at once.
If you were targeted
- 1Don't sign in from links inside shared documents; go to Microsoft 365 directly.
- 2Check unexpected shares with the sender through a channel you already use.
- 3If you entered your password, change it at once, sign out of all sessions and tell your IT team.
- 4Use phishing-resistant sign-in such as passkeys or security keys where possible.
- 5Report the email to your IT or security team.