Fake Bid PDFs Lead to Microsoft Credential Theft

A real credential-phishing campaign used a project bid invitation and a password-protected PDF to target employees involved in sales and contract work. The PDF led victims through a convincing fake document-sharing site and then to a counterfeit Microsoft sign-in page that sent entered credentials to the attackers.

Key findings

• The campaign used the business urgency of a project bid invitation to make recipients more likely to open the message and attachment.
• The email used a password-protected PDF, which can prevent email security tools from inspecting malicious content inside the file.
• The unlocked PDF contained a OneDrive-styled button labeled "View" or "Download" that linked to a non-OneDrive domain.
• The phishing site maintained the bid-document narrative with a fake shared drive containing apparently contract-related files.
• After victims clicked "Download Selected," the site requested their email address and redirected them to a fake Microsoft sign-in page.
• The initial sender may be a legitimate but compromised email account, making sender-address checks alone insufficient.

Who’s being targeted

• Commonly targeted roles: Sales, Business Development, Proposal Management, Procurement, Account Management, Finance, All Microsoft 365 users.
• Affected industries: Professional services, Sales organizations, Business development, Procurement and contracting, Organizations responding to project bids.
• Attack channels: email, website.
• Impersonated: Prospective customer or contracting organization, Microsoft sign-in and a shared document platform.

Awareness takeaways

• Treat unexpected bid invitations as high-risk until the opportunity is verified through a known business contact or established procurement channel.
• Do not assume a password-protected attachment is safe; confirm why it was sent and verify it before opening or enabling any links inside it.
• Before clicking a document-sharing button or entering credentials, inspect the destination domain and ensure it matches the service being claimed.
• A familiar or legitimate-looking sender address does not prove a message is safe, because attackers may send phishing from compromised accounts.

Red flags to watch for

• The deadline uses an impossible date: "August 35, 2026."
• The attachment is password-protected, preventing normal email scanning and inspection.
• The supposed OneDrive button links to a non-OneDrive domain.
• The site asks for an email address after the user has already reached a supposed shared-document page.
• The Microsoft sign-in page uses lastingonlineexperiences[.]de rather than a Microsoft domain.
• The credentials are submitted to a separate attacker-controlled server.