Skip to content
Phantom Preview Phishing Campaign Targets Microsoft 365 Users via Frame.io

Phantom Preview Phishing Campaign Targets Microsoft 365 Users via Frame.io

First seen 20 Oct 2026, 16:14 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 17:12 UTC
  • •Phantom Preview phishing campaign exploited Frame.io notifications to target Microsoft 365 users.
  • •22 emails were sent to a single enterprise tenant, evading traditional security checks.
  • •Ocean Security's AI agent discovered hidden links leading to a fake login page.

A phishing campaign named Phantom Preview was identified by Ocean Security on August 27, 2026, targeting Microsoft 365 credentials. The attackers sent 22 emails to a single enterprise tenant within two hours, using legitimate Frame.io notifications to bypass email security. The emails appeared to be routine file-sharing notifications, with links concealed in a PDF that led to a fake Microsoft 365 login page. The initial email was reported just three minutes after delivery, but conventional security measures failed to detect the threat. Ocean Security's AI agent, Ray, uncovered the hidden link by analyzing the PDF's annotations. The malicious domain msauth.biz was registered shortly before the attack and showed no detections on VirusTotal at the time. Frame.io was not compromised; attackers exploited its notification system to distribute phishing emails. Security teams are advised to scrutinize shared files for hidden links to unfamiliar domains.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-27
Phantom Preview phishing campaign launched
22 phishing emails were sent to a single enterprise tenant, using Frame.io notifications to bypass security checks.
Hackread
2026-10-20
Ocean Security reports findings
Ocean Security published details about the phishing campaign and the methods used to evade detection.
ocean.security

More articles in this cluster (2)

Following this threat?

Track DigitalOcean in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

How can I identify these phishing emails?
Look for emails with legitimate-looking Frame.io notifications and check for hidden links in shared PDFs.
What should I do if I receive one of these emails?
Do not click on any links; report the email to your IT security team for further investigation.
Is Frame.io itself compromised?
No, Frame.io was not compromised; attackers exploited its legitimate notification system.