PhantomDOM Phish Hijacks Microsoft 365 Sessions

A real phishing operation called PhantomDOM used a SharePoint-themed PDF from an apparently legitimate sender to lead people to a fake-but-familiar Microsoft 365 sign-in experience. Instead of simply copying a login page, the attackers controlled a remote browser session, allowing them to capture and use the victim’s sign-in activity.

Key findings

• The PhantomDOM operation began with a SharePoint-themed PDF sent from an apparently legitimate sender.
• The attack used redirects and browser checks before showing a Microsoft authentication experience.
• The victim saw a familiar Microsoft sign-in experience, but the attacker controlled the remote browser where it ran.
• The phishing client mirrored the remote browser page, forwarded keyboard and clipboard activity over WebSocket, and allowed live operator control.

Who’s being targeted

• Commonly targeted roles: All employees, Microsoft 365 users, Finance, Executives, Human Resources, IT administrators.
• Attack channels: email, website.
• Impersonated: Microsoft 365 / SharePoint.

Awareness takeaways

• Treat unexpected document-sharing PDFs with caution, even when the sender appears legitimate. Verify unexpected shared files using a known communication channel before opening them.
• Do not trust a sign-in page solely because it looks like Microsoft 365. Navigate to Microsoft 365 through a known bookmark or approved company portal rather than signing in after following a document link.
• Be especially alert when a document link causes unusual redirects, browser checks, or requests to sign in again. Report the message rather than continuing if the sequence feels unexpected.

Red flags to watch for

• An unexpected SharePoint-themed PDF from a sender that only appears legitimate.
• The PDF leads through redirects and browser checks before the sign-in page appears.
• A familiar-looking Microsoft sign-in page is not proof that the login session is legitimate.