---
title: "Ask Huntress: Fake .XPS Invoice Leading to Credential Phishing"
url: https://daily.dev/posts/ask-huntress-fake-xps-invoice-leading-to-credential-phishing-fcni6ab0l
source_url: https://www.huntress.com/blog/ask-huntress-fake-xps-invoice-leading-to-credential-phishing-page-a79e21e93dc0
type: article
source: "Huntress Blog"
published: 2026-05-31T07:43:37.428Z
updated: 2026-05-31T09:36:17.984Z
tags: ["security", "authentication", "phishing"]
reading_time: 5
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Ask Huntress: Fake .XPS Invoice Leading to Credential Phishing

**[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 5 min read · 0 upvotes · 0 comments

## Summary

A phishing campaign used a fake .XPS file disguised as a PDF invoice to lure victims into visiting a credential harvesting page mimicking Adobe Reader. The attack bypassed anti-spam filters and used social engineering to steal email credentials. Defense recommendations include SPF record validation, user security training, DNS reputation filtering, and multi-factor authentication (MFA) for Office 365 and G Suite to limit damage even if credentials are compromised.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.huntress.com/blog/ask-huntress-fake-xps-invoice-leading-to-credential-phishing-page-a79e21e93dc0>

## Similar posts on daily.dev

- [New phishing attack leverages PDFs and Dropbox](https://daily.dev/posts/new-phishing-attack-leverages-pdfs-and-dropbox-pdtkrgw7z) · CSO Online · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#phishing](https://daily.dev/tags/phishing)

[View this post on daily.dev](https://daily.dev/posts/ask-huntress-fake-xps-invoice-leading-to-credential-phishing-fcni6ab0l)