September 15, 2026

IMPORTANT: If you received an email from my account with the subject “New RFP Shared With You - 15/9/2026,” it was not sent by me. Delete the email and its PDF attachment. Do not follow the link embedded in the PDF.

What Happened

On September 15, 2026, I discovered that my email account had been compromised and used to distribute more than 1,700 phishing messages. Approximately 1,400 were sent to valid email addresses. The messages appeared to come legitimately from my account and included my normal email signature.

The unauthorized message had the subject “New RFP Shared With You - 15/9/2026.” Its body asked the recipient to review an attached proposal. The PDF attachment contained the link that led to the phishing authentication process.

My investigation found unauthorized access to my email account, unauthorized application/API-level access, and an email rule used to conceal the attack by deleting phishing messages from Sent Items. I have taken multiple steps to secure the account and investigate the activity.

How My Account Was Compromised

Six days earlier, I received a similar phishing message from the legitimate email account of a trusted security-industry colleague. The message was specifically crafted around a normal professional activity: an RFP for physical security consulting services.

On my workstation PC, I opened the attached PDF and clicked the link it contained. The link led to an authentication process that closely resembled a Microsoft authentication process I routinely use. I entered my Microsoft credentials and the process also involved the Microsoft Authenticator app on my phone.

Only when the authentication process ended at a blank page did I suspect that something was wrong. I contacted the purported sender later that day and confirmed that his email account had been compromised.

The six-day interval is important. Visible malicious activity did not begin immediately after my interaction with the phishing site. A delay should not be interpreted as evidence that an account is safe. If you believe you attempted to authenticate through a phishing link, prompt response can still matter.

The Authentication Prompt May Not Look the Same for Everyone

At least one recipient of the phishing message sent from my account followed the PDF link and was prompted to sign in with Google rather than Microsoft. He recognized the situation as suspicious and abandoned the process. This means recipients should not decide whether this advisory applies to them based solely on whether they saw a Microsoft sign-in prompt.

The important indicators are the message subject, the attached PDF, the link embedded in that PDF, and any authentication request that followed.

Why This Type of Attack Can Be So Convincing

This was not a generic message about an unexpected package or an unfamiliar invoice. The message that compromised my account came from a trusted professional colleague and fit the context of my work. The authentication sequence also resembled a process I routinely encounter when accessing protected business documents from many client and partner companies.

Microsoft has documented adversary-in-the-middle (AiTM) phishing attacks that can intercept credentials and authenticated sessions, including attacks that can defeat conventional multifactor authentication by capturing a session token. The behavior I experienced is consistent with that general class of attack, although I am not asserting that the exact technical mechanism used against my account has been conclusively identified.

AI adds another concern. Microsoft has reported 2026 phishing campaigns in which generative AI was used to create highly targeted messages aligned to a recipient’s role, including RFP-themed lures. I do not know whether AI was used to create the message that targeted me. The practical lesson is that polished wording, professional relevance, and familiarity with a recipient’s work are no longer strong indicators that a message is legitimate.

What You Should Do

If You Received the Email but Did Not Open the PDF

Delete the email and its PDF attachment.
Do not forward the original phishing message to other people except as directed by your organization’s IT or cybersecurity team.
If this is a corporate account, follow your organization’s normal procedure for reporting phishing.

If You Opened the PDF but Did Not Follow Its Link

Close and delete the PDF and the email.
Opening the PDF is not the same as submitting credentials. Based on what I observed, the phishing authentication process began after following the embedded link.
If this is a corporate device or account, report the incident according to your organization’s procedures so your security team can determine whether any additional review is appropriate.

If You Followed the Link but Did Not Attempt to Authenticate

Close the page and do not return to it.
Do not enter credentials, approve an authentication request, enter a verification code, or authorize access.
For a corporate account or device, notify your IT or cybersecurity team and provide them with this advisory and the phishing email subject.
Follow any additional instructions provided by your organization.

If You Attempted to Authenticate

Act promptly. Do not assume that multifactor authentication prevented compromise merely because an authenticator app, verification code, or other second factor was involved.

For a corporate account: contact your IT or cybersecurity team immediately. Tell them that you followed a phishing link and attempted authentication, and provide this advisory.
For a personal account: go to the service through a known legitimate website or app - not through the phishing message - and use the provider’s account-security and compromised-account procedures.
A password change alone may not be sufficient. Depending on the service, response may also include revoking active sessions or tokens, reviewing registered authentication methods, reviewing connected or consented applications, and checking forwarding settings and mailbox rules.
Review recent sign-in and account activity for anything you do not recognize, using the provider’s legitimate security pages.
If the same password was used for any other account, change it there as well and use a unique password.

Guidance for Corporate Email Users and Security Teams

Corporate users should involve their IT or cybersecurity team rather than relying only on self-service password changes. The security team may have access to identity, email, endpoint, application-consent, and audit information that the individual user cannot see.

For Microsoft 365 environments, Microsoft’s current compromised-account guidance includes actions such as:

Revoking active sign-in sessions and refresh tokens.
Reviewing registered MFA devices and authentication methods.
Reviewing applications to which the user has granted consent and revoking unauthorized access.
Reviewing mailbox forwarding and Inbox rules, including hidden rules.
Reviewing audit logs, message traces, suspicious sign-ins, and messages sent during the affected period.
Resetting credentials as part of the broader investigation and recovery process.

Other email and identity platforms have equivalent investigation and recovery capabilities. Use the procedures appropriate to your organization and service provider.

Lessons for Security Professionals

A message originating from the real account of a trusted colleague is not necessarily trustworthy if that colleague’s account has been compromised.
Professional relevance is no longer a reliable authenticity signal. A phishing lure can be closely matched to a recipient’s role, projects, terminology, and normal business activity.
Multifactor authentication remains important, but some phishing techniques are specifically designed to capture or abuse authenticated sessions. Phishing-resistant authentication methods and layered controls matter.
A successful compromise may not produce immediate visible activity. Treat a suspected authentication compromise as time-sensitive even when nothing unusual appears to happen afterward.
Account recovery should consider persistence mechanisms - sessions/tokens, connected applications, authentication methods, forwarding, and mailbox rules - rather than focusing only on the password.
When something feels wrong after authentication - an unexpected blank page, unusual redirect, or inconsistent workflow - report it immediately rather than waiting for additional evidence.

A Note About AI and Phishing

AI does not change the basic nature of phishing: the attacker is still exploiting trust. What AI can change is the speed and precision with which convincing lures can be produced. Microsoft has reported threat actors using generative AI to create role-specific phishing messages and to improve the language, localization, and professional context of social-engineering campaigns.

There is no evidence presently available to me that establishes whether AI was used in the attack described on this page. The reason for mentioning AI is broader: security awareness practices that depend heavily on poor grammar, generic wording, or obviously irrelevant subject matter are becoming less dependable.

Authoritative Guidance

Microsoft - Respond to a compromised cloud email account: Microsoft Learn

Microsoft - Session cookie theft / AiTM investigation guidance: Microsoft Defender XDR

Microsoft Security - AiTM phishing and business email compromise: Microsoft Security Blog

Microsoft Security - AI-enabled phishing using role-specific lures, including RFP themes: Microsoft Security Blog

CISA - General phishing guidance: CISA Phishing Guidance

About This Advisory

This advisory is intended to help recipients understand and respond to the phishing incident involving my email account. It provides general security guidance, not system-specific incident-response instructions. Organizations should follow their own cybersecurity procedures and the guidance of their email and identity providers.

Ray Bernard
President and Principal Consultant
Ray Bernard Consulting Services (RBCS)