The DOCX That Was Actually a Fake M365 Admin Console

An email landed in the business and housing office of a small private college with a subject line built to make an administrator flinch: a domain registration required renewal or service would be interrupted. The body was empty. Everything the attacker wanted the reader to do lived in a single attachment, and that attachment claimed to be a Word document.

It was not. Pulled from the message and decoded byte by byte, the file was raw HTML wearing a DOCX label.

That mismatch is the entire attack. There is no macro here, no embedded executable, no exploit payload buried in a document structure. The file simply lies about what it is, and everything downstream flows from that lie.

An Empty Body and a Lying File Type

The message carried no text at all, which is itself a signal. A legitimate renewal notice explains itself in prose. This one offloaded all of its persuasion onto the attachment, whose name was crafted to look like an administrative export from an admin portal, complete with the recipient mailbox spliced into the filename. The declared content type was a Microsoft Word document. The actual bytes were HTML and JavaScript.

That divergence between declared type and real content is a masquerade, and it defeats the mental model most users carry. Someone who has been trained to fear macros sees a Word icon and assumes the risk lives inside a document they can choose not to enable. Here there was no document. Double-clicking handed the file to a browser, which rendered it as a web page and ran its script immediately, with no macro prompt to click through and no protected-view banner to ignore.

The Admin Console That Builds Itself

Once open, the page drew a fake Microsoft 365 Admin Console: a loading animation, the familiar chrome, the visual language of a Microsoft property that a business-office administrator would touch routinely. It was theater, rendered entirely from the local file. Nothing on screen came from Microsoft.

While that animation played, the script did the real work. It assembled a URL at runtime rather than hard-coding one, stitching together a randomized six-to-ten character subdomain on the attacker domain hcf-fr[.]com, reaching it over the non-standard port 8443, at the path /impact. Into the query string it dropped the recipient's actual email address, lifted from the filename and reused as a personalization token, then iframed that credential-harvesting page inside the fake console. To the victim, entering a password felt like re-authenticating to an admin portal they already trusted. In reality the keystrokes were flowing to a randomized subdomain on infrastructure the attacker controlled.

Building the URL in JavaScript at open time, instead of embedding a static link, is a deliberate evasion. There is no clickable link in the email and no static URL in the attachment for a scanner to extract and reputation-check ahead of time. The malicious destination only exists once the file runs.

See Your Risk: Calculate how many threats your SEG is missing

Softfail at the Door, Pass Down the Hall

The authentication trail is where this case earns its severity. The message originated from a Bangladesh-hosted sending IP, and SPF returned a softfail for that address against a transitioning record. DKIM was absent at the origin: the sending domain never signed the message. DMARC therefore failed outright for the header From. On every signal that actually ties to the domain the reader saw, this message was unauthenticated.

It still reached the inbox, and the reason is a hop. The message transited a Microsoft relay that produced its own DKIM pass on an onmicrosoft.com domain. That pass belongs to the relay, not to the sender, and it covers nothing about the origin. But it was enough to drive a composite authentication pass, and that composite pass pulled the spam confidence level down to a mid-range 5, comfortably inside delivery range. This is relay laundering: an attacker borrows the reputation of a trusted intermediary to launder a message that failed authentication at its source. A Microsoft 365 tenant reading the composite verdict at face value will pass exactly this kind of message.

Mapping to MITRE ATT&CK

The tradecraft maps cleanly onto the MITRE ATT&CK framework. The delivery is T1566.001 Spearphishing Attachment, since the entire payload rode in an attached file. The DOCX-labeled HTML is T1036.008 Masquerade File Type, a file whose declared type deliberately misrepresents its contents. And the reliance on the recipient double-clicking the attachment to trigger the script is T1204.002 User Execution: Malicious File.

Indicators of Compromise

Detection and What to Watch For

Static defenses struggle with this pattern by design. There is no link in the body to check, no known-bad URL in the attachment to match, and the malicious address does not exist until the file runs and builds it. Signature and reputation checks have nothing to bite on. The signals that matter are structural: a declared file type that does not match the actual bytes, an attachment whose extension opens a browser rather than an office application, an empty body leaning entirely on that attachment, a filename carrying the recipient's own address, and a composite authentication pass sitting on top of an origin that failed SPF and DMARC.

This is where our Adaptive AI on the IRONSCALES platform reads the message the way an analyst would, weighing the DOCX-versus-HTML mismatch, the unauthenticated origin behind a relay-laundered pass, and the runtime URL construction as one coherent story rather than a set of checks that individually clear. That relationship-level view is what 35,000+ security professionals across 17,000+ organizations lean on when the server-level verdicts come back clean.

The 2024 Verizon Data Breach Investigations Report puts stolen credentials in 38 percent of breaches, the single most common initial action, and the human element in 68 percent of breaches. The Microsoft Digital Defense Report 2024 documents the same drift toward abusing trusted services and identity rather than breaking cryptography. The FBI's 2023 Internet Crime Report ranked business and identity impersonation among the costliest fraud categories, which is precisely the trust this fake console tried to spend.

The takeaway is narrow and practical. Treat a file's claimed type as a claim, not a fact, and treat any attachment that renders a login as hostile until proven otherwise. Microsoft does not mail you an admin console as an attachment. For teams building that reflex, CISA's guidance on stopping phishing early is a solid reference: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one