Locked and Loaded: Phishing through Fake Bids and Protected Documents

This is a credential phishing campaign targeting professionals through fake business bid invitations. It uses password-protected PDF attachments to evade automated security scans. The PDFs contain a fake OneDrive button that redirects victims to a fraudulent document-sharing site, prompting them to enter their email and then credentials on a counterfeit Microsoft login page. The campaign exploits trusted business workflows and familiar brand interfaces to bypass technical and human defenses.

• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26
• M365 Token Spray and Replay Campaign Compromises Business Email AccountsCampaign2026-10-22
• Disruption Targets Major Chinese-Language Phishing Kits with Japanese FocusCampaign2026-10-14
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14