Locked PDFs and Hijacked Australian Domains

Jake Marchese | SOC Analyst | 7 September 2026

Your email gateway can see the PDF. It just can't open it.

Across our managed Australian environments, we've been tracking an AiTM phishing campaign that chains together compromised business email accounts, password-protected PDF lures, and adversary-in-the-middle infrastructure hosted on hijacked Australian domains. The attack bypasses email gateway scanning, MFA, and domain reputation checks in a single chain. Here's the full kill chain we observed and disrupted.

Here's what we found.

Password-protected PDFs as the delivery mechanism

The attack starts with a compromised email account at a legitimate Australian organisation - in this case a small incorporated association. The attacker sends targeted emails to a handful of employees at the victim company, each containing a PDF attachment that is password-locked, with the password included in the email body. Email security gateways can't detonate or scan an encrypted PDF, so the malicious URL inside passes through undetected.

Hijacked Australian domains as AiTM infrastructure

The link inside the PDF points to an AiTM phishing page hosted as a subdomain of a second compromised Australian business - a small accounting firm. Both domains are legitimate .com.au registrations with valid ABNs, which means they carry trusted domain reputation scores. The phishing page itself acts as a transparent proxy between the victim and Microsoft's real login portal, capturing both the credentials and the authenticated session token in real time. MFA completes successfully from the victim's perspective. The attacker now holds a valid, MFA-authenticated session.

Immediate attacker persistence

Within minutes of capturing the session, the attacker registered new software OATH authenticator apps on the compromised accounts and created inbox rules to suppress any emails referencing the compromised sender domain. Even if the password is reset, the attacker's registered authenticator maintains access, and the inbox rule prevents the victim from seeing any follow-up about the original phishing email.

Detection, containment, and a specific remediation order

Not every recipient clicked. But for those who did, the compromise was confirmed rapidly through a combination of ISP-anomaly detection and anomalous token usage patterns. Microsoft Attack Disruption disabled the affected accounts automatically, and our SOC escalated to the customer within minutes with a specific remediation sequence: revoke sessions, remove attacker-registered MFA device IDs, delete the malicious inbox rules, then reset passwords. Resetting the password before removing the attacker's authenticator app just hands them a new session.

Weeks later, a separate detection in another Australian environment flagged a sign-in attempt from a Turkish residential proxy IP targeting an account that historically authenticates from South Africa. The correct username and password were entered, but conditional access blocked the session due to device compliance requirements. The detection fired because the internet service provider had never been associated with the user or the organisation - an ISP-level anomaly, not just an IP or country mismatch.

Hunting queries your team can run today

// Detect sign-ins from an ISP never previously seen for that user
// Baselines the prior 89 days and flags new ISPs in the last 24 hours
SigninLogs
| where TimeGenerated >= ago(90d)
| where ResultType == "0" // successful sign-ins only
| where isnotempty(AutonomousSystemNumber)
| extend ISP = AutonomousSystemNumber
| summarize
    EarliestSignIn = min(TimeGenerated),
    SignInCount = count(),
    Apps = make_set(AppDisplayName, 5)
    by UserPrincipalName, ISP, IPAddress, Location
| join kind=leftanti (
    SigninLogs
    | where TimeGenerated between (ago(90d) .. ago(1d))
    | where ResultType == "0"
    | where isnotempty(AutonomousSystemNumber)
    | summarize by UserPrincipalName, AutonomousSystemNumber
) on $left.ISP == $right.AutonomousSystemNumber, UserPrincipalName
| where EarliestSignIn >= ago(1d)
// Results show users signing in from ISPs with no history in the prior 89 days
// Investigate any sign-in from a residential ISP in a different country to the user's norm

// Hunt for PDF attachments on emails classified as phishing that were still delivered
// These may include password-protected PDFs that bypassed gateway detonation
EmailAttachmentInfo
| where TimeGenerated >= ago(90d)
| where FileType == "pdf"
| join kind=inner (
    EmailEvents
    | where TimeGenerated >= ago(90d)
    | where DeliveryAction == "Delivered"
    | where ThreatTypes has "Phish"
    ) on NetworkMessageId
| summarize
    AttachmentCount = count(),
    DistinctRecipients = dcount(RecipientEmailAddress),
    Subjects = make_set(Subject, 5)
    by SenderFromDomain, SenderFromAddress
| where AttachmentCount > 1
| sort by AttachmentCount desc
// Focus on external senders delivering phishing-flagged PDFs to multiple recipients

// Detect inbox rules created to suppress emails matching a keyword
// A hallmark of AiTM post-compromise activity
OfficeActivity
| where TimeGenerated >= ago(90d)
| where Operation == "New-InboxRule"
| extend RuleParams = tostring(Parameters)
| where RuleParams has "DeleteMessage" or RuleParams has "MoveToFolder"
| where RuleParams matches regex '"Name":"(FromAddressContainsWords|SubjectContainsWords)","Value":"[^"]+'
| project TimeGenerated, UserId, Operation, RuleParams
// Matches only rules with non-empty keyword values -- filters out Outlook default empty params
// Cross-reference with recent sign-in anomalies on the same account

What to look for in your environment

Type	Indicator	Context
Attachment	Password-protected PDF with password in email body	Email gateway evasion - cannot be detonated by sandbox
Infrastructure	AiTM page hosted on a subdomain of a compromised .com.au business	Trusted domain reputation bypasses URL filtering
Persistence	New software OATH authenticator registered post-sign-in	Attacker maintains access even after password reset
Concealment	Inbox rule with FromAddressContainsWords matching sender domain	Hides follow-up emails and security notifications from victim
Evasion	Sign-in from residential proxy IP matching victim's country	Defeats location-based conditional access policies
Signal	ISP/ASN never previously associated with user or organisation	Strongest early indicator of residential proxy AiTM

Attackers aren't registering cheap lookalike domains anymore - they're compromising legitimate Australian businesses and using their infrastructure to send phishing emails that pass SPF, DKIM, and DMARC, carrying encrypted attachments that email gateways can't scan, pointing to AiTM pages hosted on trusted .com.au domains. If your detection strategy relies on domain reputation and MFA as the last line of defence, this chain bypasses both. Fortian detected and contained this attack within minutes because we baseline ISP behaviour per user, not just IP addresses and countries. If you want to know whether your environment can detect this, talk to us at fortian.com.au.