Locked and Loaded: Phishing through Fake Bids and Protected Documents

This Cofense report details a credential-phishing campaign that leverages password-protected PDF attachments posing as "invitation to bid" documents, which reveal a OneDrive-style lure that redirects victims to fake Microsoft sign-in pages to harvest credentials; the report includes IOCs (malicious PDF hashes, payload URLs, and IP addresses) and explains how encryption and legitimate-looking senders help the campaign evade detection.