Hackread – Cybersecurity News, Data Breaches, AI and More
Scammers Abuse Frame.io Notifications to Steal Microsoft 365 Credentials
Ocean Security found a phishing campaign, dubbed Phantom Preview, that abused legitimate Frame.io notifications and hidden PDF links to deliver fake Microsoft 365 login pages. Cybersecurity researchers at Ocean Security identified a targeted adversary-in-the-middle (AiTM) phishing campaign on August 27, 2026, that abused Adobe Frame.io‘s legitimate share notifications to evade conventional email security checks. Dubbed Phantom Preview, the campaign used a PDF to conceal a link to a fake Microsoft 365 login page that sent 22 emails to a single enterprise tenant within two hours.