Teach a Man to Phish and He’s Set for Life
Summary: A reader received a phishing email posing as a Microsoft 365 delivery report, carrying an attachment that Windows displayed as "lme.pdf" but which was actually an .eml file named "fdp.eml" disguised using a right-to-left override (RLO) unicode character. The message passed through Microsoft Office 365 with all detections enabled without being caught, while Mimecast detected the encoding and renamed the attachment to "___fdp.eml"; opening the file renders a fake Microsoft alert whose "Restore Messages" link bounces through an open redirect on LinkedIn to a spoofed Office 365 login page.
Why it matters: Check Point figures cited in the piece put Microsoft at nearly 30 percent of all brand phishing attempts in Q2 2023, and KrebsOnSecurity first covered RLO-based phishing in 2011 - so the lure riding your own email provider's branding is a well-worn path, not a novel one.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026