Confidentiality Note: Client names, domains, email addresses, and other identifying information have been removed or generalized to protect confidentiality.
Executive Summary
A client reported a suspicious follow-up email containing a PDF attachment. Although the email appeared legitimate and came from a professional-looking domain, the client questioned its authenticity because they were not expecting the attachment.
I analyzed the email and its embedded URL using both automated security tools and manual investigation techniques. Initial reputation checks showed no malicious detections, but a detailed investigation inside an isolated virtual machine revealed a convincing clone of the Microsoft 365 login page designed to harvest user credentials.
The phishing attempt was confirmed, the malicious domain was blocked, the incident was reported, and precautionary actions were taken to protect the client's account.
Scenario
A client received a follow-up email that appeared to be part of an existing email conversation. The message included a PDF attachment containing an embedded hyperlink.
Although the email looked professional and the sender appeared legitimate, the client had recently completed phishing awareness training and realized they were not expecting this attachment.
Instead of opening it, the client reported the email for security analysis.
That decision prevented a potential credential compromise across the client's Microsoft 365 environment.
Investigation Process
The email was reviewed for obvious phishing indicators. At first glance, everything appeared legitimate.
- Professional email formatting
- Convincing sender domain
- PDF attachment
- No obvious spelling or branding mistakes
Nothing immediately suggested malicious activity.
The attached PDF contained a hyperlink directing the user to an external website.
Instead of opening the link on a production system, the investigation was performed inside an isolated, disposable Windows 10 virtual machine running on VMware to reduce risk to the client environment. No production system was used for manual verification.
Before visiting the website, the embedded URL was checked using VirusTotal.
- No antivirus engines detected the URL as malicious.
- No public threat intelligence identified the domain.
- The domain appeared to be newly created.
At this stage, automated tools suggested the website was safe. However, newly created phishing domains often evade reputation-based detection because they have not yet been reported or indexed by security vendors.
The URL was opened inside the isolated virtual machine. The website first displayed a verification page before redirecting to a login screen.
The final page was an almost perfect replica of the Microsoft 365 login portal. Everything looked genuine. However, one critical detail exposed the attack:
Although the page visually matched Microsoft's login screen, the URL was completely different from Microsoft's official authentication domain.
This confirmed the webpage was designed to steal Microsoft 365 credentials.
Findings
| Finding | Result |
|---|---|
| Email Appearance | Professional and convincing |
| Attachment | PDF containing embedded URL |
| VirusTotal Detection | No detections (0 / 90+) |
| Domain Reputation | Newly registered |
| Login Page | Microsoft 365 clone |
| Authentication URL | Not an official Microsoft domain |
| Final Assessment | Credential Harvesting Phishing Site |
Response & Containment
After confirming the phishing attempt, the following actions were taken:
- Reported the phishing website.
- Blocked the malicious domain through organizational security controls.
- Notified the legitimate owner of the compromised infrastructure (where applicable).
- Recommended an immediate Microsoft 365 password reset for the affected user as a precaution.
- Preserved the email and attachment for incident documentation.
✓ No credentials were compromised during the incident.
Key Takeaways
This investigation highlighted several important security lessons:
A clean VirusTotal result does not guarantee a website is safe.
Newly registered phishing domains often bypass reputation-based detection.
Manual verification remains essential when investigating suspicious emails.
Users trained in phishing awareness provide an important layer of defense.
★ Always verify the destination URL—not just the visual appearance of the login page.
Outcome
Incident Resolved — Threat Contained
The phishing attempt was successfully identified before any user credentials were entered. The malicious domain was blocked, the incident was documented, and precautionary security measures were implemented to prevent future compromise.