The PDF From Someone You Trust That Hands Over Your Email

It doesn't come from a stranger. It comes from someone you actually deal with: your accountant, a supplier, the club secretary, a customer you invoiced last month. The subject line is ordinary. There's a PDF: Invoice, Remittance, Contract for review. Inside it there's just a button: View document.

You click it. A Microsoft sign-in page appears, exactly as it always does. You type your password, your phone buzzes, you approve the code. The document "fails to load", or a harmless PDF opens. You shrug and get on with your day.

By lunchtime, everyone in your address book has received the same email. From you.

Why it's so easy to fall for

Everything we've been taught about spotting scams points the wrong way here.

• The sender is real. It isn't a lookalike address. It's your contact's actual mailbox, which was taken over the same way yours is about to be. Sometimes it even arrives as a reply in an existing conversation.
• A PDF feels safe. Most people now know not to open strange attachments that ask to "enable content". A PDF that just shows a button doesn't trip that alarm. The dangerous part sits at the other end of the link, not in the file.
• The link often goes somewhere real first. Many of these bounce through a real OneDrive or SharePoint address, so both your spam filter and your eye see a Microsoft link and relax.
• The sign-in page really is Microsoft's. That's the clever bit. The fake page passes everything you type through to the real Microsoft login and passes the real responses back to you. The padlock is real. The code you approve is real. You really are signing in to your own account, just with someone standing in the middle.

Microsoft's own security team reports that PDFs were the main delivery method for QR-code phishing through early 2026, rising from 65% of those attacks in January to 70% in March, and that 78% of all email threats it saw were links rather than attachments that do damage on their own.

The cookie part, without the jargon

Think of a hotel. At reception you prove who you are with your password and your two-step code. Reception then hands you a key card, and for the rest of your stay the doors only check the card, not you.

Your browser works the same way. Once you've signed in, Microsoft or Google gives it a small token called a session cookie, and from then on that cookie is you. This scam sits at the reception desk and photocopies the key card as it's handed over. The attacker never needed your code; you used it for them, and they walked off with the result.

That's the single most important thing in this article, and it's why people who "changed their password straight away" find the attacker still in their mailbox a week later.

What happens next: your mailbox becomes the next PDF

Getting into your email isn't the goal. It's the starting point.

1. A trusted contact sends you a PDF. Their account was taken over earlier in exactly this way.
2. You sign in to view it. Password, code, approved. All real, all relayed.
3. Your session is copied. The attacker is now signed in as you, from somewhere else, with no code needed.
4. They hide their tracks. Inbox rules automatically delete replies like "did you mean to send this?" and bury security alerts, so you don't notice.
5. They read everything. Invoices, bank details, who pays whom and when. That's the raw material for the invoice-redirection scam that follows.
6. They send the same PDF to everyone you know. Your clients, your suppliers, your contacts list. It all goes from your real address, so it's trusted.

Some versions also register their own sign-in method on your account, or approve a "trusted app" that keeps access to your mailbox even after everything else is reset. That's why cleaning up properly takes a checklist, not a single change.

It's not only Microsoft 365, either. The best-known of these kits, Tycoon2FA, was built to target Outlook, SharePoint and Gmail. Microsoft and Europol disrupted it in March 2026, and Microsoft's figures show volumes from it dipped by about 15% before the operators moved to new hosting and carried on. These kits are sold as a subscription service; the people sending the emails don't need any technical skill at all.

How to spot it

This is what a typical one looks like. Every part of it is designed to look ordinary.

• 1You weren't expecting it. This is the only test that reliably works. A real contact, a document you didn't ask for, a vague message? Stop.
• 2The PDF is just a button or a QR code. A real invoice or contract has content. A one-page PDF whose only job is to send you somewhere else is a lure.
• 3It asks you to sign in to view a document someone sent you. If it's attached, you already have it. Being sent off to log in is the trap.
• 4Look at the address bar, not the page. Microsoft sign-ins happen on addresses like login.microsoftonline.com, login.microsoft.com or login.live.com; Google's at accounts.google.com. Anything else asking for that password isn't them, however perfect the page looks.
• 5After signing in, the document "can't be opened". If that's happened to you recently, go straight to the checklist below.

The habit that beats all of this: if you didn't expect a document, ring the sender on a number you already have and ask if they sent it. Don't reply to the email. If their account has been taken over, the attacker answers, and they'll say yes.

If you clicked it: the first hour

Don't be embarrassed. This one is built to catch careful people, and speed matters far more than blame. Do these in order. If you're on a business Microsoft 365 account and you're not the admin, ring whoever is (or ring us) at step one.

1. Sign out everywhere first

   This is the step people skip, and it's the one that actually throws the attacker out, because it cancels the stolen session.

   Work account (admin): Microsoft 365 admin centre → Users → the user → Sign out of all sessions · Personal Microsoft: account.microsoft.com → Security · Google: myaccount.google.com → Security → Your devices

2. Change the password

   From a computer or phone you trust, and to something you haven't used anywhere else. If you used the same password on other sites, change those too.

3. Check your sign-in methods

   Look for a phone number or authenticator app you don't recognise and remove it. Attackers add their own so they can get back in.

   Microsoft: mysignins.microsoft.com → Security info · Google: myaccount.google.com → Security → 2-Step Verification

4. Check inbox rules and forwarding

   Delete any rule you didn't create, especially ones that delete, move or mark mail as read. Switch off any forwarding to an address you don't know.

   Outlook: Settings → Mail → Rules, and Settings → Mail → Forwarding · Gmail: Settings → Filters, and Forwarding

5. Look at Sent and Deleted

   See what went out in your name and who it went to. Check Deleted items for replies the rules may have hidden. That's often where you find out who's already been asked about it.

6. Remove apps you didn't approve

   Any app with access to your mailbox that you don't recognise can keep reading your mail after everything else is fixed.

   Microsoft: myapps.microsoft.com, or the admin centre · Google: myaccount.google.com → Security → Your connections to third-party apps

7. Warn your contacts, but not by replying

   Send a short, separate message (or a text to the important ones) so the loop stops with you.

   Something like"Please don't open any PDF or 'shared document' email from me sent on [date]. My email was compromised and it wasn't from me. If you clicked it and signed in, tell your IT person today. Sorry for the hassle, [Name]"

8. If money is involved, ring the bank now

   If a payment went out, or bank details were changed, ring your bank immediately and ask for the payment to be recalled. The earlier you ask, the better the odds of getting it back. Then report it to the Gardaí. Any Garda station will take the report.

9. Think about whose data was in there

   If the mailbox held customers' personal information, a business may need to report it to the Data Protection Commission, normally within 72 hours of becoming aware. Get advice on that quickly rather than guessing.

If you're not sure you've caught everything, or the account is already locked and you can't get in, that's exactly what our account recovery service is for. It's done remotely, and getting the attacker out properly matters more than getting back in quickly.

What actually stops it

The strongest fix is free, and it's already on your phone.

• Passkeys. A passkey is tied to the real website's address, so it simply won't work on a fake page. There's nothing to relay. Microsoft recommends phishing-resistant sign-in like passkeys for exactly this reason. We've a plain-English guide to setting them up.
• A password manager. It fills your password in automatically on the real site, and fills in nothing on a lookalike. When it suddenly "doesn't recognise" the page, that's your warning.
• Never sign in from a link in an email. If an email says you need to log in, close it, open the website yourself, and sign in there.
• Ring before you open unexpected documents. Thirty seconds, a number you already hold. It beats every technical control on this list.
• For businesses on Microsoft 365: the plans that include Conditional Access can refuse sign-ins from unknown devices and block the other trick these kits now use (the "enter this code at microsoft.com/devicelogin" variant). It's a settings job rather than new software, and worth having someone check.
• A two-minute brief for staff. Show them this article. The rule that stops it is "unexpected document, ring first".

The text codes and phone-approval prompts most people use are still far better than nothing. They stop the bulk of simpler attacks. They just weren't built for an attacker who sits in the middle of a real sign-in.

Why this matters more for small businesses

Banking & Payments Federation Ireland's FraudSMART figures show Irish fraud losses reached €179 million in 2025, up 27%, with "authorised push payment" fraud (where the victim is tricked into sending the money themselves) now 45% of the total by value. A taken-over business mailbox is the perfect tool for that: the fraudster can see real invoices, reply in real conversations, and change bank details from an address your customers trust. The Law Society has warned solicitors about this exact pattern, because the money involved in a house sale makes them a prime target: a compromised account sends a "contract" document link, then rules divert client emails.

And because the next email goes to your contacts, the damage doesn't stop with you. Your customers get caught out by something that came from you.

Summary

This scam works because it borrows trust: a real contact, a harmless-looking PDF, a real Microsoft sign-in. It beats two-step codes by copying the session you get after signing in, and it spreads by sending itself to everyone in your mailbox. The one habit that stops it is ringing before opening a document you didn't expect. If you've already clicked, sign out everywhere first, then change the password and work down the checklist. Then warn your contacts so it ends with you.

Sources: Microsoft Threat Intelligence: Inside Tycoon2FA (March 2026) · Microsoft: email threat trends, Q1 2026 · FraudSMART / BPFI, September 2026 · Law Society of Ireland: cyber alerts · An Garda Síochána: caught out by a scam · NCSC Ireland: phishing quick guide · Elastic Security Labs: Tycoon 2FA after the takedown