What happened
The PhishU blog published on 8 November 2026 a profile of PhantomDOM, a browser-in-the-middle phishing kit first documented by email-security vendor ZeroBEC on 5 November 2026. According to the write-up, the kit reaches Microsoft 365 users through phishing emails from abused or compromised senders carrying a SharePoint-themed HR benefits-enrollment PDF with an obfuscated subject line using Unicode homoglyphs. Microsoft, SharePoint and DocuSign are impersonated and are not involved.
How the scam works
Clicking the PDF button leads through redirects and fingerprinting pages to a Microsoft-branded "verify it's you" page gated by a Cloudflare Turnstile CAPTCHA. After that, the victim's keystrokes, password and MFA entry are relayed to an attacker-controlled remote browser that performs the genuine Microsoft sign-in, so the authenticated session stays with the attacker. The victim is then sent to a decoy DocuSign not-found page.
Because the real Microsoft login completes in the attacker's browser, ordinary one-time codes and app-based MFA do not stop the theft: the attacker receives the same session the victim thinks they just opened. The hijacked session in the documented case reached Outlook, Microsoft 365 Search, Copilot Chat and OneDrive and requested passkey-registration options, which could lock the victim out further. PhishU says ZeroBEC is the only source so far and no threat actor has been named.
PhishU recommends phishing-resistant MFA such as passkeys or FIDO2 security keys, with weaker fallbacks closed. Treat unexpected HR benefits PDFs with caution, especially when the subject line looks odd; open benefits enrolment only through your employer's known portal. Anyone who entered credentials on a page reached from such a PDF should reset their Microsoft 365 password from a trusted device, revoke active sessions, review mailbox rules and passkey settings, and alert their IT team.
Source
PhishU blog (citing ZeroBEC), 8 November 2026: https://phishu.net/blogs/blog-phantomdom-a-browser-in-the-middle-kit-that-completes-microsoft-365-mfa-inside-the-attacke.html
