New Phishing Tactic Exploits Legitimate Microsoft Business Notifications

A sophisticated phishing campaign has emerged, demonstrating how cybercriminals are weaponizing legitimate infrastructure to bypass traditional email security filters. By injecting malicious instructions into authentic Microsoft 365 business notifications, attackers are successfully tricking employees into contacting them under the guise of technical or billing support.

The Mechanics of the Hijacked Notification

The attack begins with a genuine, automated email sent from Microsoft’s verified domain, microsoft-noreply@microsoft.com. Because the email originates from a trusted address, it consistently evades standard email server security protocols and spam filters that typically flag suspicious communication.

The message functions as a standard purchase confirmation for a Microsoft 365 Apps for Business subscription. However, the attackers manipulate the “Billing information” section of the document. While this area is intended to display the subscriber’s company name and billing address, scammers replace these details with their own contact information. They include a fraudulent phone number and a call to action, urging the recipient to contact “Microsoft” support for assistance regarding the transaction.

Psychological Manipulation in the Workplace

This campaign specifically targets corporate employees by exploiting common workplace anxieties. By presenting an invoice for expensive, unauthorized software subscriptions, the scammers trigger a fear of professional repercussions. Employees, worried that an unnecessary or unauthorized purchase might cause trouble at work, are more likely to act quickly to resolve the “issue” without consulting their IT department or following standard procurement procedures.

The campaign mirrors the tactics warned against by Microsoft’s official security guidance, which highlights that cybercriminals frequently create a false sense of urgency. By pressuring victims to call or click immediately, attackers hope to prevent the target from thinking critically or seeking advice from a trusted colleague.

How to Protect Your Organization

Security professionals emphasize that awareness remains the strongest defense against these hybrid email-and-phone scams. To mitigate risk, organizations should implement the following best practices:

• Verify via Official Channels: Never use contact information provided within an unexpected or suspicious email. If you receive a notification regarding a billing discrepancy, navigate directly to the company’s official website or use a phone number listed on a verified membership card.
• Exercise Caution with Urgent Requests: Be inherently suspicious of any message that demands immediate action. Scammers use urgency to bypass your natural skepticism.
• Flag New Senders: While this attack uses a legitimate sender address, be wary of any email that your system marks as a “first time” sender or that includes an [External] tag.
• Consult Internal IT: Before calling a support number provided in an email, contact your internal IT or finance department to verify the validity of the purchase or the legitimacy of the request.

Key Takeaways

• Trusted Origins: Attackers are using legitimate email addresses to ensure their messages reach the inbox, rendering traditional spam filters less effective.
• Targeted Fear: The scam relies on the victim’s fear of professional trouble to drive them toward making a phone call to the scammers.
• Verification is Vital: Always verify support contact information through official, independent sources rather than relying on the details provided in the body of an email.

As cybercriminals continue to evolve their methods to blend in with everyday business operations, the importance of maintaining a “pause and verify” mindset becomes increasingly critical. When in doubt, gradual down, step back and confirm the legitimacy of the request through established, internal company channels.