A phishing campaign hides its real link inside a PDF that requires a password to open, then walks the victim through a completely genuine Microsoft login page to steal account access without ever asking for a password.

 

What happened

Researchers uncovered a campaign running between April and May 2026 that uses password-protected PDF attachments to launch device code phishing attacks against Microsoft 365 accounts. According to Cyberpress, the attack starts with a phishing email disguised as a legal notice, carrying a PDF that requires a password included in the email itself to open. Once the victim enters that password and opens the document, they find a link prompting them to view further files. Rather than pointing to an obviously suspicious address, the link uses an open redirect hosted on a genuine Microsoft domain or another trusted platform, a design choice that lets the malicious link hide behind a web address the victim would normally trust without a second look.

 

Going deeper

The technique abuses a legitimate Microsoft feature called the OAuth 2.0 Device Authorization Grant, originally built to let devices without a keyboard, such as smart TVs or printers, sign in by entering a short code generated on a separate device with a screen and keyboard. After clicking through a CAPTCHA designed to filter out automated security scanners, the victim reaches a fake corporate portal and is instructed to copy a one-time code. That code was not generated for the victim's benefit. The attacker's own server had already started a login request and produced that exact code in advance. When the victim copies it and is redirected to Microsoft's genuine device login page, the domain really does belong to Microsoft, so the victim feels safe entering the code and completing their normal multi-factor authentication. Once approved, Microsoft's own servers issue an access token, an identity token, and a refresh token directly to the attacker's application rather than to the victim, giving the attacker silent, ongoing access to read the victim's email, pull files from OneDrive, and monitor Teams conversations without ever needing a password.

 

In the know

Device code phishing has expanded rapidly across the criminal ecosystem throughout 2026, and healthcare has repeatedly appeared among the sectors affected. According to The Hacker News, a separate device code phishing campaign tracked since February 2026 had already compromised more than 340 Microsoft 365 organizations across construction, non-profits, real estate, manufacturing, financial services, healthcare, legal, and government sectors, using a comparable range of lure themes including DocuSign impersonation and voicemail notifications. The consistent presence of healthcare in these campaign target lists, combined with a PDF-based delivery method that adds a further layer of disguise around the malicious link, points to device code phishing becoming a standard, adaptable technique rather than a single group's signature tactic.

 

The big picture

A password-protected PDF adds a psychological layer that plain phishing links lack. Requiring the recipient to actively enter a password before viewing the document creates the impression of legitimate security, when in practice it exists mainly to keep automated email scanners from inspecting the file's contents before delivery. For healthcare organizations, where staff regularly receive legal notices, compliance documents, and password-protected attachments from insurers, legal counsel, and regulatory bodies as a matter of routine, this lure blends into expected communication patterns far more easily than a generic phishing email would. According to Paubox's 2026 Healthcare Email Security Report, 53 percent of breached healthcare organizations in 2025 used Microsoft 365, making the platform this specific technique targets the same one already carrying the largest share of healthcare's email security exposure.

 

FAQs

Why does a password-protected PDF help attackers bypass security scanning?

Automated email security tools scan attachments for malicious content before a message reaches the inbox. A PDF that requires a password to open cannot be automatically opened and inspected by those scanning tools, allowing the attachment to pass through undetected while still being fully accessible to the human recipient who has the password provided in the email itself.

 

What is an open redirect and why does it make a malicious link harder to spot?

An open redirect is a legitimate website feature that forwards visitors to a different destination based on a parameter in the URL. Because the visible portion of the link points to a genuinely trusted domain, such as an official Microsoft address, recipients checking the domain name see something familiar and safe, without necessarily noticing the redirect instruction hidden further along in the full web address.

 

Why does entering a device code on Microsoft's real login page still result in account theft?

The code the victim enters was generated by the attacker's own login request, not the victim's. When the victim approves that code, they are unknowingly authorizing the attacker's application to receive access, rather than authorizing their own device. Microsoft's systems correctly verify the victim's identity through MFA, but the resulting access token is delivered to the attacker's session rather than the victim's.

 

Why can't victims tell the difference between a legitimate device code login and this attack?

Every visible element of the process, the domain name, the login page design, and the multi-factor authentication prompt, is completely genuine and belongs to Microsoft. The only distinguishing factor is whether the victim personally initiated the login request on their own device moments earlier, information that is not visible anywhere on the login screen itself.

 

What organizational control most directly prevents this type of attack?

Configuring Conditional Access policies to block or restrict the device code authentication flow for accounts that have no legitimate need for it removes the underlying mechanism this technique depends on entirely, regardless of how convincing the PDF lure or redirect chain is designed to be.