Password-Protected PDFs Are the New Sandbox Killer: How a Compromised .gov Account Delivered an Unopenable Payload

Attackers compromised a paraprofessional's government Microsoft 365 account and used it to send a password‑protected PDF (passcode plaintext in the email body) to multiple targets via BCC, allowing the message to pass SPF/DKIM/DMARC while preventing automated scanners from opening the attachment; IRONSCALES' community-driven behavioral detection quarantined the messages and the report recommends flagging passcode-plus-attachment patterns, applying behavioral analysis beyond authentication, and hardening trusted .gov/.edu accounts.