PDF trapped that steals M365 session/account password


Recommended Posts

Hello,

Someone that i know i received a mail on Outlook 2021 (on Win 11 25H2 with the patch tuesday ot 14th october installed) which contains a PDF trapped she thought it was legitimate and she has opened the PDF. Just after she has noticied that there was a huge amount of spam send which is mail address. By opening the PDF the hacker has stolen his password of sessions/ M365 account (it's the same password for the windows sessions and his M365 account). The hacked has set a rule to move automatically the mails arriving in the inbox to a specific folder. 

How is-it possible to stole the password just by opening the PDF ?

Thanks by adance

  • Like 1
On 09/11/2025 at 02:05, xillibit said:

Hello,

Someone that i know i received a mail on Outlook 2021 (on Win 11 25H2 with the patch tuesday ot 14th october installed) which contains a PDF trapped she thought it was legitimate and she has opened the PDF. Just after she has noticied that there was a huge amount of spam send which is mail address. By opening the PDF the hacker has stolen his password of sessions/ M365 account (it's the same password for the windows sessions and his M365 account). The hacked has set a rule to move automatically the mails arriving in the inbox to a specific folder. 

How is-it possible to stole the password just by opening the PDF ?

Thanks by adance

It isn’t. I’ve seen and investigated this phishing attempt dozens of times. They open it, it triggers a prompt to login (usually via SSO), and they do. It’s all over after that. If they don’t login, they don’t get their account stolen. 
 

More importantly though, DO NOT OPEN SUSPICIOUS FILES. 

On 09/11/2025 at 09:05, xillibit said:

Hello,

Someone that i know i received a mail on Outlook 2021 (on Win 11 25H2 with the patch tuesday ot 14th october installed) which contains a PDF trapped she thought it was legitimate and she has opened the PDF. Just after she has noticied that there was a huge amount of spam send which is mail address. By opening the PDF the hacker has stolen his password of sessions/ M365 account (it's the same password for the windows sessions and his M365 account). The hacked has set a rule to move automatically the mails arriving in the inbox to a specific folder. 

How is-it possible to stole the password just by opening the PDF ?

Thanks by adance

There is a missing part of the story. 

If she in fact didn't enter her credentials, then it sounds like it stole her sessions cookies.

Didn't the same thing happen to Linus Tech tips?

Per the Verge

Quote

According to Sebastian, someone on the Linus Media Group’s team downloaded “what appeared to be a sponsorship offer from a potential partner” and launched the included PDF with the terms of that offer. But Sebastian says this offer actually included malware that accessed “all user data from both their installed browsers” — including session tokens — which effectively gave the bad actor “an exact copy” of the browsers that they could export and use to wreak havoc without needing to enter security credentials.

Are we even sure what she was trying to open was a PDF or an executable? 

 

  • Like 2
On 09/11/2025 at 11:47, adrynalyne said:

It isn’t. I’ve seen and investigated this phishing attempt dozens of times. They open it, it triggers a prompt to login (usually via SSO), and they do. It’s all over after that. If they don’t login, they don’t get their account stolen. 
 

More importantly though, DO NOT OPEN SUSPICIOUS FILES. 

@Warwagon sounds like he's on the right track, given what we know. It's called "cookie hijacking" or "session hijacking".  Malicious PDFs, or sometimes, .exe files disguised as PDFs, since Windows hides file extensions by default, have been used in the past to steal locally stored session cookies for already signed-in accounts without requiring any manual login activity or further interaction from the target user.  If this is what has happened to the OP and they still have access to the account; invalidating all currently logged in sessions, then logging back in and changing your password should be enough to boot the hackers from your account.  The longer you leave them with access however, the more likely it is they either already have, or will eventually do something like change the password the something of their choosing, remove 2FA authenticators or otherwise take greater ownership of the account.

Linus of "Linus Tech Tips" was a victim of this a couple of years ago.

 

  • Like 2
On 10/11/2025 at 10:55, xillibit said:

It can't be an executable because the extensions of files are set to showed

It doesn’t matter at this point. Either login consent was given or session cookies were stolen. You have two very plausible explanations. 
 

At the end of the day, never open suspicious files or unexpected attachments. 

  • Like 3

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • It's amazing that anyone still uses this bloated trash.
    • @Sayan...I have defended you at various points as I hope you know. This headline however is utter trash...shame on you sir!
    • An actual cosmic "Eye of Sauron" had been looking straight at us all along by Sayan Sen Image by Kovin P. Vasquez via Pexels | Not representative An international team of researchers has solved a long-standing mystery surrounding a distant blazar known as PKS 1424+240, helping explain why it produces some of the brightest high-energy gamma rays and cosmic neutrinos ever observed despite appearing to have a relatively slow-moving jet. The findings were published on June 6 in Astronomy & Astrophysics Letters. The study addresses a broader challenge in astrophysics: understanding how extreme cosmic objects accelerate particles to very high energies and produce very high-energy (VHE) photons and neutrinos. PKS 1424+240 is located billions of light-years from Earth. It has attracted attention for years because it is both a powerful source of VHE gamma rays and the brightest known neutrino-emitting blazar in the sky, according to observations by the IceCube Neutrino Observatory. It is also associated with one of the strongest peaks in IceCube's nine-year neutrino sky map A blazar is a type of active galactic nucleus powered by a supermassive black hole that pulls in surrounding matter and launches jets of plasma moving close to the speed of light. What makes blazars unique is their orientation. One of their jets points almost directly toward Earth, making them appear exceptionally bright across the electromagnetic spectrum and allowing scientists to study some of the most extreme physical processes in the Universe. The scientists exclaimed it's like the 'Eye of Sauron' in deep space. Usually, the brightest gamma-ray-emitting blazars are expected to have jets that appear to move very quickly. However, radio observations of PKS 1424+240 suggested that its jet was moving much more slowly, creating a contradiction that became part of a long-running problem known as the "Doppler factor crisis." To investigate, researchers analyzed 15 years of observations from the Very Long Baseline Array (VLBA), a network of 10 radio antennas spread across the continental United States, Hawaii and St. Croix. Using a technique called Very Long Baseline Interferometry (VLBI), astronomers combine signals from widely separated radio telescopes to create a virtual Earth-sized telescope capable of revealing extremely fine details. The team combined 42 polarization-sensitive radio images collected between 2009 and 2025, creating a much deeper and more detailed view of the jet than had previously been possible. The observations were carried out as part of MOJAVE (Monitoring Of Jets in Active galactic nuclei with VLBA Experiments), a long-running program that studies the brightness, polarization and magnetic field structures of jets produced by active galaxies. The project aims to better understand how activity near supermassive black holes is linked to high-energy radiation and neutrino emission. “When we reconstructed the image, it looked absolutely stunning,” said Yuri Kovalev, lead author of the study and Principal Investigator of the European Research Council-funded MuSES project at the Max Planck Institute for Radio Astronomy. “We have never seen anything quite like it — a near-perfect toroidal magnetic field with a jet, pointing straight at us.” The image revealed an unusual geometry. The researchers found that Earth lies almost directly in line with the jet, with a viewing angle of less than 0.6 degrees. In simple terms, astronomers are looking almost straight down the jet. This turned out to be the key to the mystery. Because the jet is aimed almost directly at Earth, a relativistic effect called Doppler boosting dramatically increases its apparent brightness. The study found that this effect boosts the emission by a factor of about 30 while also making the jet appear slower than it actually is. “This alignment causes a boost in brightness by a factor of 30 or more,” said Jack Livingston, a co-author at the Max Planck Institute for Radio Astronomy. “At the same time, the jet appears to move slowly due to projection effects — a classic optical illusion.” The nearly head-on view also gave scientists a rare look at the jet's magnetic field. Using polarized radio signals, they detected a clear toroidal, or doughnut-shaped, magnetic field component. The observations suggest the jet carries an electric current and that its magnetic field helps launch, shape and stabilize the flow of plasma. Researchers believe this magnetic structure may also play a key role in accelerating particles to energies high enough to produce both gamma rays and neutrinos. “Solving this puzzle confirms that active galactic nuclei with supermassive black holes are not only powerful accelerators of electrons, but also of protons — the origin of the observed high-energy neutrinos,” Kovalev said. The research was conducted under the MuSES (Multi-messenger Studies of Energetic Sources) project, which investigates how active galactic nuclei accelerate particles and generate different cosmic signals, including light and neutrinos. Scientists say understanding how protons are accelerated and linked to neutrino production remains one of the major unanswered questions in astrophysics. The findings help explain why some blazars can appear to have slow jets while still producing extremely bright high-energy emissions. More broadly, the study strengthens the link between relativistic jets, magnetic fields, gamma rays and high-energy neutrinos. Researchers say the results provide new clues about how some of the Universe's most powerful natural particle accelerators work and offer important insights for multimessenger astronomy, which combines different types of cosmic signals to study extreme events in space. Source: European Research Council, EDP Sciences This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • Gotenks98 is right... Outlook (new) is absolute trash. Doesn't Mozilla have an Enterprise Version of Firebird?
  • Recent Achievements

    • One Month Later
      lamborghiniv10 earned a badge
      One Month Later
    • Week One Done
      lamborghiniv10 earned a badge
      Week One Done
    • Reacting Well
      X-No-file earned a badge
      Reacting Well
    • One Month Later
      pestcontrol46 earned a badge
      One Month Later
    • Week One Done
      pestcontrol46 earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      510
    2. 2
      PsYcHoKiLLa
      273
    3. 3
      Skyfrog
      75
    4. 4
      +Edouard
      72
    5. 5
      FloatingFatMan
      69
  • Tell a friend

    Love Neowin? Tell a friend!