A Russian-linked group allegedly stole sensitive contact data from the Netherlands National Police after getting access to an employee’s email account. The podcast describes a realistic spearphishing lure: an email invitation to a “European Defence Summit” that includes a link or a QR code in a PDF leading to a fake Microsoft Teams login page designed to capture credentials.
The lure described in this incident began with a personal invitation delivered by email, framed as an invite to a European Defence Summit. The message included either a link or a QR code embedded in a PDF attachment. Following that link or scanning the code led targets to a login page designed to look like Microsoft Teams. Once a victim entered their username and password, the attacker captured those credentials. This access was reportedly used to compromise a staff member's email account at the Netherlands National Police Force, which enabled theft of contact data on over 64,000 officers and informants.
The pretext relied on plausibility rather than technical complexity. An invitation to a defense-related summit is a believable reason for government, law enforcement, and defense personnel to expect correspondence, register online, and log in to a conference or collaboration platform. Embedding the malicious link inside a PDF and using a QR code added a layer of obfuscation, since QR codes are harder to inspect before scanning and often bypass email link scanning tools. The destination page's resemblance to a familiar Microsoft Teams login also reduced suspicion at the critical moment of credential entry.
Organizations, particularly those in government, law enforcement, and defense, should train staff to treat unsolicited event invitations as high-risk, especially when the call to action involves scanning a QR code or clicking a link inside a PDF. When a login page appears that looks like Microsoft Teams but was reached via an unexpected invite, staff should be encouraged to stop and verify through a trusted channel, such as the official event website or an internal security contact, rather than entering credentials directly. It's also worth reinforcing that attackers in cases like this were focused on intelligence collection rather than immediate financial gain, meaning any credential compromise, even one that seems minor, can lead to significant downstream data exposure. Anyone who regularly handles contact databases, informant information, or other sensitive directories should receive particular attention in this kind of awareness training, given the scale of data that a single compromised account can expose.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Targets received an email invitation to a European Defence Summit containing a link or a QR code inside a PDF. Clicking or scanning led to a fake Microsoft Teams login page designed to capture usernames and passwords.
Attackers gained access to a staff member's email account and used that access to steal contact data on over 64,000 officers and informants.
Microsoft and Dutch intelligence publicly attributed the operation to a group referred to as Void Blizzard, also known as Laundry Bear, according to the podcast.
No. The podcast frames it as intelligence collection, stating the goal was gathering intel to exploit later rather than deploying ransomware or extorting money.
You get an email: personal invite to a “European Defence Summit” with a glossy PDF attached. Looks legit, right? This exact trick was used against the Netherlands National Police. One compromised inbox, and data on over sixty-four thousand officers and informants was stolen by a group called Void Blizzard. Here’s the move: the PDF says, 'Scan this QR to join on Microsoft Teams.' You scan, a page that looks like Teams pops up, asks you to sign in, and, bang, they’ve got your username and password. If an unsolicited invite pushes you to scan a QR or click a PDF link to log in, don’t do it, open Teams or your calendar yourself and check the meeting there.
A China-nexus threat group targeted government and policy organizations across Asia using spear-phishing emails tailored to the victim’s interests. The emails used spoofed trusted senders and a realistic fake Gmail attachment preview that linked to attacker-controlled pages, ultimately installing…
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
Microsoft says it uncovered and disrupted an underground marketplace (“YAM Store”) that sold phishing kits and access to cloud accounts, enabling massive global phishing and SMS scam campaigns. The operation allegedly supported over a billion scam messages since January 2026 and targeted 75,000+…
A China-aligned espionage group (TA419) targeted U.S. AI policy experts by impersonating well-known public figures and sending credible policy-related invitations. After victims replied, the attackers sent shortened links that led to a fake OneDrive login designed to capture passwords, MFA codes,…
Researchers say a China-aligned group (TA419) impersonated well-known AI policy figures and an Anthropic executive to lure US AI policy experts into replying to emails about a fake advisory committee or Senate report. Once a target engaged, the attackers sent shortened links that led through a fake…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
