Frame.io Phishing Hides an AiTM Microsoft 365 Login Inside a Shared PDF

At a glance

• Sender: Frame.io’s own notification system

• Volume: 22 emails to one enterprise tenant in two hours on Aug 27, 2026

• Payload: a PDF preview with no clickable link; the real link was a /URI annotation inside the file

• Target: Microsoft 365 credentials via an adversary-in-the-middle (AiTM) login clone

What happened

Employees received “Jason Pitts shared “BTF Project” with you” from Frame.io’s real notification system, so the emails passed gateway checks. The share link pointed to Frame.io, and the shared PDF rendered as a non-clickable preview. The malicious link was hidden inside the file.

How the redirect chain worked

1. Frame.io notification email

2. Frame.io share link

3. A pages.dev redirector referenced inside the PDF

4. A 301 redirect to a newly registered domain, msauth[.]biz, behind a Cloudflare Turnstile CAPTCHA

5. Obfuscated JavaScript serving a Microsoft 365 login clone

Why it got past email security

How Ocean caught it

Ray, Ocean’s central intelligence engine, retrieved the raw PDF through Frame.io’s API, inspected its /URI annotations, and found a redirect to a Cloudflare Pages subdomain. Ray followed every hop to the Microsoft 365 login clone and confirmed credential phishing before anyone entered a password.

What security teams should do

1. Block msauth[.]biz and its subdomains

2. Hunt for SaaS share notifications whose PDFs contain /URI annotations pointing off-platform, especially to new domains or *.pages.dev and *.workers.dev hosts

3. Inspect the shared asset itself; don’t rely on delivery signals or first-hop reputation for trusted SaaS shares

Indicators