Scammers are abusing an internal Microsoft account to send spam links

The New Face of Email Phishing: Scammers Abuse Microsoft’s Internal Infrastructure

Cybercriminals have pivoted to a sophisticated new method for bypassing traditional email security filters: abusing internal Microsoft accounts. Rather than relying on spoofed domains or external servers that are easily flagged, scammers are exploiting the trust inherent in Microsoft’s own institutional email infrastructure.

This technique transforms legitimate enterprise communication channels into vectors for disinformation and phishing. By leveraging internal account notification addresses—originally designed for secure alerts like two-factor authentication codes or service confirmations—attackers can disseminate spam links and phishing lures that appear virtually indistinguishable from official communications.

Exploiting Trusted Domains in Business Email Compromise

The core strength of this attack lies in its flawless veneer of legitimacy. Traditional email security measures, such as SPF, DKIM, and DMARC checks, are built to detect obvious impersonation. They look for lookalike domains or blatant spoofing attempts from outside sources.

However, when malicious communication originates from an account that passes these rigorous authentication checks, defenses often fail to raise alarms. This is because the emails are utilizing Microsoft’s actual sending servers.

Attackers are not simply spoofing an address; they are leveraging functional, trusted components of the cloud service itself to ensure high inbox delivery rates. The observed pattern typically involves:

• Creating Controlled Environments: Threat actors set up seemingly new customer accounts within the Microsoft ecosystem.
• Mimicking Official Notifications: These accounts generate emails that mimic official alerts from major tech giants.
• Complex Social Engineering: The goal moves beyond simple credential harvesting to compliance through manufactured urgency, such as faking unauthorized financial transactions that require immediate "refund" calls.

The Mechanics of Infrastructure Abuse

This abuse extends deep into administrative configurations that are rarely scrutinized by average end-users or standard security monitoring tools. To maintain operational camouflage, threat actors establish multiple tenant environments within the Microsoft 365 structure.

Each tenant serves a distinct function in the attack chain, ensuring redundancy and obfuscating the entire operation's origin point should one segment be compromised. The actual abuse often involves misusing legitimate forwarding or notification features built into the platform.

Key indicators of this systemic compromise include:

• Abuse of OnMicrosoft Domains: Utilizing newly provisioned or unfamiliar *.onmicrosoft.com domains for initial staging and communication.
• Display Name Manipulation: Injecting entire, fabricated narratives—like fake billing statements—directly into the organization's displayed name field, which is then automatically pulled into service emails.
• Process Simulation: Triggering legitimate system events (e.g., a 'purchase' or 'subscription change') to generate confirmation emails that possess perfect authentication headers.

Mitigating Trust Exploitation in Enterprise Email Security

Combating this level of abuse requires a fundamental shift in security strategy. Organizations must move beyond asking who is sending the email and start analyzing how the message is constructed and what its underlying process reveals. The reliance on established trust mechanisms necessitates a layered, behavioral approach rather than simple signature matching.

Defenders must implement advanced analysis tools capable of inspecting metadata far beyond the header lines. Critical protective measures include:

• Metadata Deep Inspection: Analyzing fields like organization display names and system-generated footers for anomalous, narrative text that falls outside standard operational messaging templates.
• Behavioral Anomaly Detection: Flagging communications that exhibit a high degree of structural legitimacy but contain an unverified call to action, such as calling a phone number listed in the body.
• User Training Refocus: Shifting user education from "Don't click links" to "Verify all unexpected, urgent requests via a pre-established, known-good channel."

The current landscape reveals that simply enforcing strict email standards like DMARC is insufficient when the threat actor operates within the trusted framework itself. In modern cyber warfare, trust is the most valuable commodity being weaponized.

Until service providers issue higher-level controls restricting how organizational metadata can be repurposed for unsolicited external contact initiation, security teams must assume that any email citing an urgent financial matter from a major cloud provider warrants immediate, manual verification. This verification must always occur through official corporate channels, never via the link or number provided in the suspicious message itself.