Phishing Campaign Hijacks Frame.io Alerts to Harvest Microsoft 365 Logins

Security researchers at Ocean Security have uncovered a new phishing operation, dubbed "Phantom Preview," that exploits legitimate notifications from the video collaboration platform Frame.io to trick users into surrendering their Microsoft 365 credentials.

The scheme works by sending victims an authentic‑looking Frame.io alert that contains a concealed link to a malicious PDF. When the PDF is opened, it either directs the user to a counterfeit Microsoft sign‑in page or runs a script that captures the entered username and password, forwarding them to the attackers.

Ocean Security says the campaign leverages the trust users place in official Frame.io communications, which are typically delivered through email and in‑app notifications. By embedding the malicious payload within a seemingly innocuous PDF, the perpetrators bypass many conventional email filters that focus on suspicious URLs or attachments.

While the exact scale of the operation remains unclear, early indicators suggest the attackers are targeting professionals who regularly use both Frame.io and Microsoft 365 services—particularly video producers, editors, and corporate teams that rely on cloud‑based collaboration tools.

Experts warn that the blend of a reputable service’s branding with a hidden malicious link makes the phishing attempt especially effective. Users are advised to verify the source of any unexpected Frame.io notification, hover over links to inspect URLs, and avoid opening attachments unless they are certain of their provenance.

Microsoft has not yet issued a formal advisory on the incident, but the company routinely recommends multi‑factor authentication (MFA) as a safeguard against credential theft. Enabling MFA can render stolen passwords useless without the second authentication factor.

Ocean Security has shared indicators of compromise, including sample phishing emails and the malicious PDF hash, with major security vendors and CERT teams. The researchers hope coordinated mitigation efforts will reduce the campaign’s reach before it can compromise more accounts.

As phishing tactics continue to evolve, the incident underscores the importance of vigilance when handling routine notifications from trusted services. Organizations are encouraged to conduct regular security awareness training that highlights how legitimate branding can be weaponized by attackers.