The Budget Email Came From a Coworker. The Free PDF Tool Came With a Passenger.

At half past two on a Thursday afternoon last week, people at one of our clients started getting an email about the budget. It came from a colleague. Not a look-alike address, not a stranger with a familiar name pasted on top. His real mailbox, his real name, sent to the people who would expect to hear from him about exactly that subject. He had not sent it. Someone signed in to his account from another country had, and before the afternoon was over that someone had pushed more than six thousand messages out of it, to everyone the mailbox had ever written to.

Within the hour three separate tickets reached us. One person wrote that the email from her colleague about the budget "apparently was spam," which is the right instinct in six words. Another wrote that she had clicked the link when she opened it on her phone and wanted to know what the next steps were, which is the right instinct too, and the more useful of the two because she said so quickly. And one of the messages landed in the inbox of one of our own technicians, who recognised it for what it was.

And at ten to four, on the laptop of the man whose name was on the email, the endpoint protection flagged a file and stopped it. The file was an installer. Its name said it was a free PDF tool.

We will come back to the order of events, because it matters and because we cannot prove all of it. First the two lessons, since they are the point.

An email from a coworker defeats every check you were taught

Most of the advice people have absorbed about phishing is about the sender. Look at the address. Hover over the name. Is it external. Does the domain match. All good advice, and all of it useless the moment an attacker is sending from a real mailbox inside your own organization, because every one of those checks passes. The address is right. The name is right. The internal tag is right. The email filter sees a colleague writing to colleagues, which is what it is supposed to let through.

This is not rare. It is the normal second step. An attacker who gets into one mailbox does not sit in it. They use it to send a convincing message to everyone that person knows, inside the company and out, because a lure from a known sender gets opened at a rate no stranger could dream of. Six thousand messages in an afternoon is what that looks like. We wrote two weeks ago about a scam that arrived from a hijacked business in another state. This one came from the next desk.

So the check that still works is not about the sender. It is about the ask. A colleague who wants you to open a document would normally have said something about it, or attached it, or would answer when you walked over. A link to "the budget" with nothing else around it is a request to act with no context, and that is true whoever appears to have sent it. The people who caught this one caught it on the shape of the message, not the address. That is the habit to build.

And if the email seems to be from someone in your building, there is a check nobody else has. Ask them. Not by replying, because the attacker is reading that mailbox. Walk over, or call. "Did you send me something about the budget" takes fifteen seconds and settles it, and it tells the colleague his account is in someone else's hands, which is the most useful thing he can hear that day.

There is a quieter lesson in the sign-in itself. Someone in another country opened that mailbox, and nothing rang. Sign-in alerting, the kind that flags a login from an unexpected place the minute it happens, was not yet in place for that account. It is now. The post we wrote two weeks ago describes a day where it was in place, and the difference is the difference between a password reset within the hour and six thousand emails.

Free PDF converters are rarely free

The installer the endpoint protection caught was named like a PDF tool, the kind of thing people search for when a document will not open or needs turning into another format. The FBI's Denver field office put out a warning about exactly this in March of last year: free online document converters and download tools that do the job they advertise, and quietly install something else, or read the file you uploaded for passwords and account details on the way through. Microsoft has a category for the softer end of the same market. It calls it potentially unwanted applications, and the defining example is software that offers to install other software not signed by the same company. Bundling, in plain words.

Windows does try to help. When a program is downloaded, the built-in reputation check compares it against known bad files and against the list of files that are well known and downloaded all the time. If a file is on neither list it shows a warning and asks you to think. The trouble is that the warning looks like every other warning, the person is in a hurry to get a document converted, and the button that makes it go away is right there. We see that screen clicked through every week.

The rule we give clients is short. If you need a tool you do not have, ask IT, and the answer will usually be that you already have it. Both of the major PDF viewers convert and combine files. Word opens PDFs and saves them back out. Your phone's camera scans. The free download with the cheerful name is solving a problem that was already solved, and it is the single most common way a computer in a small office ends up carrying a passenger.

The order of events, honestly

We can tell you what the records show. The sign-in came from abroad. The emails went out from half past two. The reports came in from twenty to three onward. The installer was caught at ten to four, on the sender's laptop.

What we cannot tell you from the records is which came first. The installer could have been the way in, weeks earlier, sitting quietly and sending a password home to whoever later used it. Or it could have been the second act, downloaded that afternoon from a link in the very email that was going round. Both chains happen. Both end in the same place, which is why the response does not wait for the answer.

That response is the one Microsoft publishes for a compromised account, and it is worth knowing what is on it so you can ask your own provider whether it happened. A new password, not sent by email. Every open session signed out, because a new password does not close a window that is already open. A check of the sign-in methods and the apps granted access to the account. A look for any inbox rules or forwarding the attacker left behind, which is how they keep reading after they are locked out. Then the sign-in log, to learn where else the account has been. On the laptop, the endpoint protection had already done its part by stopping the file, and the machine still gets checked, because an installer that was caught is evidence that someone was trying.

One thing to do this week

Tell your staff the two sentences this post is really about. First: an email from a coworker asking you to open something with no context gets a phone call before it gets a click. Second: nobody downloads a free converter, cleaner, or booster; if a tool is missing, ask IT.

Then ask yourself the quieter question. If someone in another country signed in to one of your mailboxes tonight, would anything ring before the morning?

Sources: FBI Denver Field Office, "FBI Denver Warns of Online File Converter Scam," March 2025; Microsoft Learn, "Microsoft Defender SmartScreen overview," updated April 2026; Microsoft Learn, "Block potentially unwanted applications with Microsoft Defender Antivirus," updated September 2026; Microsoft Learn, "Respond to a compromised email account in Microsoft 365," updated August 2026. The incident described is from our own work and identifies no organization, person, or product.