Overview

Since late October 2025, an increase in phishing campaigns has been observed, primarily targeting Italian companies. These campaigns employ PDF attachments masquerading as official documents, which redirect victims to counterfeit Microsoft authentication pages. The observed lures prompt users to review a document in Italian, leading to credential harvesting through spoofed Microsoft login portals designed to capture corporate email credentials.

Summary

  • Target: Italian

  • Industries: Transportation, Tourism, IT, Telecommunications, Government

  • Method: Phishing emails via PDF attachments impersonating official documents

  • Objective: Credential harvesting (corporate email accounts)

  • Language & Localization: Italian-themed lures

Example Analysis: PDF-Based Phishing Chain

  • Sample: ANY.RUN

The malicious PDFs follow a single, consistent pattern: each file contains a hyperlink visually styled as a button with Italian text inviting the recipient to open the document (e.g., “REVISIONA IL DOCUMENTO”). Above the button, a short message in Italian (e.g., “Hai ricevuto un documento da revisionare e firmare”) informs the recipient that a document is waiting for review and signature.

yraPDFyra

In this example, the PDF uses the logo of the Italian telecommunications company Mediaset, indicating brand impersonation to increase the lure’s credibility.

Actual logo:

mediaset_logo

In this case, the PDF embeds a hyperlink styled to appear as a trusted Cisco Secure Links URL, likely using the technique described here.

cisco

When clicked, the link redirects the user to phebeschool.org, a domain that appears to have previously belonged to an organization providing educational programs in West Africa for health professionals; the domain now appears compromised and is being used by threat actors as an intermediary to host or redirect phishing content that ultimately leads to counterfeit Microsoft login pages.

In the Network → Threats tab, detections show that the browser is being fingerprinted, with scripts collecting device and browser data and sending it via an HTTP POST request.

autoriz

Some domains appear to have been created specifically for the campaign, while others show signs of compromise.

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: domainName:"phebeschool.org"

PDF Filename Pattern

Observed samples follow a consistent filename template. Filenames begin with the fixed prefix Allegato_Ufficiale_ (Italian for “official attachment”) and include a short mention — often a company name or random string — that can appear anywhere after the prefix, followed by the .pdf extension.

Examples include Allegato_Ufficiale_Mediaset.pdf, Allegato_Ufficiale_ooqav_kitra-advisory.pdf, and Allegato_Ufficiale_Naviger_fhbfk.pdf among others.

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: filePath:"*Allegato_Ufficiale_*.pdf"

Distribution Method

Several phishing emails were identified containing the malicious PDF attachments. The emails appear to be automatically generated and localized in Italian, impersonating corporate communication templates. They typically reference document review, contract signing, or authentication requests — themes commonly used in business correspondence.

emlex

The sender addresses vary but often imitate legitimate sources or use compromised domains (e.g., sales01@ota.co.jp, info@itp-co.com). Each message contains a single PDF attachment following the same naming pattern:

  • Allegato_Ufficiale_VARIABLE.pdf

And a subject line urging the recipient to take immediate action (e.g., “Hai 1 giorno per firmare il modulo legale inviato da Naviger” or “Richiesta di autenticazione multi-fattore”).

Examples:

  • SHA-256: 344631d940aaaf8fa948a399837333efafaaa4a498b08537237d3cddc1c6f979

  • Sample: ANY.RUN

  • SHA-256: 8b445f673d83e7ebe9e2c30f85202f12ead658f369f8a1be124dc63d010ae263

  • Sample: ANY.RUN

  • SHA-256: 4bb76c457fdc5df080ecfb0e373d80b8d6b5c867c4e452683a4249d0765f8f3a

  • Sample: ANY.RUN

In most cases, the impersonated domains belonged to Italian organizations across multiple industries, including transportation, tourism, IT, telecommunications, and government.

IOCs:

  • Domains: mircosotfonilne.ru, phebeschool.org, vorn.revolucionww.com

Conclusion

The analyzed activity demonstrates an ongoing phishing campaign targeting Italian organizations through localized PDF attachments and brand impersonation. Consistent file naming, realistic document themes, and the use of legitimate company identities indicate a coordinated attempt to increase credibility and harvest corporate credentials.