Scammers Abuse Frame.io Notifications to Steal Microsoft 365 Credentials
Ocean Security found a phishing campaign, dubbed Phantom Preview, that abused legitimate Frame.io notifications and hidden PDF links to deliver fake Microsoft 365 login pages.
Cybersecurity researchers at Ocean Security identified a targeted adversary-in-the-middle (AiTM) phishing campaign on August 27, 2026, that abused Adobe Frame.io‘s legitimate share notifications to evade conventional email security checks.
Dubbed Phantom Preview, the campaign used a PDF to conceal a link to a fake Microsoft 365 login page that sent 22 emails to a single enterprise tenant within two hours. The messages came from the legitimate address notifications@frame.io using the subject line “Jason Pitts shared ‘BTF Project’ with you,” making them appear to be routine file-sharing notifications.
The initial link led to Frame.io‘s genuine platform, where the shared PDF appeared as a non-clickable preview. The research,shared with Hackread.com, explains that this prevented the scanners investigating the share page from readily identifying...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
