Ocean Security found a phishing campaign, dubbed Phantom Preview, that abused legitimate Frame.io notifications and hidden PDF links to deliver fake Microsoft 365 login pages.
Cybersecurity researchers at Ocean Security identified a targeted adversary-in-the-middle (AiTM) phishing campaign on August 27, 2026, that abused Adobe Frame.io‘s legitimate share notifications to evade conventional email security checks.
Dubbed Phantom Preview, the campaign used a PDF to conceal a link to a fake Microsoft 365 login page that sent 22 emails to a single enterprise tenant within two hours. The messages came from the legitimate address [email protected] using the subject line “Jason Pitts shared ‘BTF Project’ with you,” making them appear to be routine file-sharing notifications.
The initial link led to Frame.io‘s genuine platform, where the shared PDF appeared as a non-clickable preview. The research, shared with Hackread.com, explains that this prevented the scanners investigating the share page from readily identifying the malicious destination hidden inside the original document.
An employee reported the first suspicious email just three minutes after it arrived, but conventional security checks had not flagged the threat.
AI Agent Traced the Hidden Link
Ocean Security used its AI investigation agent, Ray, to retrieve the original PDF through Frame.io‘s GraphQL GetAssetForDownload path. The agent examined the document’s /URI annotations, which specify link destinations, and uncovered a URL concealed behind the preview.
Ray also searched the tenant’s email history using the campaign’s subject line, identifying 21 other matching messages.
The link hidden inside the PDF redirected targets through a Cloudflare Pages subdomain using a 301 redirect. It then sent victims to a newly registered domain, msauth.biz. It was registered via eNom on August 6, 2026, and hosted on DigitalOcean.
When researchers checked it, VirusTotal showed zero detections across 91 security engines. This means the domain had not been flagged by any of those engines at the time.
The site used a Cloudflare Turnstile CAPTCHA to make it harder for security tools to check the page automatically. After a visitor passed the test, JavaScript created a URL containing a unique token, such as ?s=gQpS40I, that led to a fake Microsoft 365 login page.
According to Ocean Security, the token was designed to prevent the link from being easily shared or reused. This helped the attackers keep the phishing page tied to its intended victim.
Defending Against Trusted Share Notifications
Ocean Security has confirmed that Frame.io itself was not compromised. The attackers used its legitimate sharing system to send phishing emails that looked like normal file notifications.
Researchers recommend checking the files behind these notifications, not just the email sender or the link. In particular, security teams should check PDFs for hidden links to unfamiliar websites, including newly registered domains and suspicious Cloudflare Pages addresses.
