As cyber defenses become more advanced, cybercriminals are stepping up their game. One of the latest and most dangerous phishing attacks we’ve seen takes a bold approach—it uses Microsoft 365’s own infrastructure to trick users, steal credentials, and potentially gain full access to sensitive accounts.
At CybrogenIT, we stay on top of threats like this to keep your business protected. Here’s what you need to know about this highly sophisticated phishing attack, how it works, and what your team can do to stay safe.
What Makes This Attack So Dangerous?
Instead of sending spoofed emails from fake domains like typical phishing scams, this new method uses real Microsoft 365 tenants and services. That means the emails are coming from legitimate Microsoft servers, making them harder for both humans and security tools to detect.
These emails look 100% real. They pass all the usual checks—SPF, DKIM, and DMARC—so they don’t trigger red flags. And because the messages are built on Microsoft’s trusted system, they land straight in inboxes without a hitch.
How the Attack Works (in Plain English)
Let’s break down the steps of the attack in a way that makes sense, even if you’re not in IT:
1. Hijacking Microsoft Tenants
Cybercriminals either create or take over multiple Microsoft 365 accounts (called “tenants”). Each tenant has a job:
- Tenant A: Creates fake transactions to trigger official-looking billing emails.
- Tenant B: Spoofs Microsoft branding and display names to boost credibility.
- Tenant C: Reroutes emails using built-in forwarding tools to avoid detection.
2. Creating Fake Admin Accounts
Hackers create administrative accounts using Microsoft’s default “*.onmicrosoft.com” domain. Because these aren’t your typical company domains, they often slip past traditional monitoring tools.
They also configure mail forwarding rules to send out phishing emails under the radar.
3. Faking Microsoft Branding
They update the Microsoft 365 tenant’s organization display name to include fake billing messages like:
“(Microsoft Corporation) Your subscription has been successfully purchased for $689.89. If this wasn’t you, call 1-888-XXX-XXXX for a refund.”
That message shows up in Microsoft’s system-generated emails, tricking people into calling the number—which is actually a fake support line used to steal information or install malware.
4. Sending the Bait
Once the attacker initiates a fake purchase in Tenant A, Microsoft automatically sends out a billing confirmation—complete with Microsoft logos, formatting, and digital signatures. But buried in that message is the phony support number from Tenant B’s display name.
This is not a spoof—it’s a legit Microsoft email with a malicious message inside.
Why Traditional Security Tools Miss This
This kind of phishing attack is clever because it:
- Uses real Microsoft domains (no fake websites involved)
- Passes all email authentication checks
- Contains no obvious malware or suspicious links
- Includes a believable, urgent reason to act (unauthorized charge)
Most email filters won’t flag this because nothing looks suspicious on the surface. And for the recipient? It feels just like any other Microsoft billing notification.
Real-World Impact
If one of your employees falls for this scam, they could:
- Hand over credentials or sensitive financial info
- Download malware directly to a work device
- Give attackers access to your Microsoft 365 environment
Once inside, attackers can move laterally across systems, access confidential files, reset passwords, or even impersonate executives to launch a broader Business Email Compromise (BEC) attack.
How to Protect Your Business
At CybrogenIT, our team is trained to detect and stop threats just like this. But here are some things you can do today to reduce your risk:
✅ Strengthen Email Security
Make sure your email filtering system checks not just for malicious links, but also suspicious display names and metadata. If your current system only scans for bad links or spoofed domains, it’s not enough.
✅ Train Your Team
Educate staff about what a real Microsoft billing email looks like—and more importantly, what not to do. No one should be calling numbers from emails without verifying them first.
✅ Verify Every Number
If you ever get an email that says “call this number for a refund,” don’t. Instead, go to the official Microsoft support page and confirm the number yourself.
➡ Microsoft Official Support Numbers
✅ Watch for .onmicrosoft.com Domains
If you get emails from a domain you’ve never seen—especially ones ending in .onmicrosoft.com—be cautious. That’s a sign the sender may not be who they say they are.
The Bottom Line
Cyber threats are evolving—and fast. What worked to stop phishing last year might not work today. That’s why businesses need a proactive security partner who understands how real-world attacks are built and how to block them before damage is done.
CybrogenIT helps small and mid-sized businesses stay one step ahead of cybercriminals. From email protection to incident response, we’ve got your back.
👇 Let’s Talk Security
If you’re unsure how secure your Microsoft 365 environment is, let us run a free cybersecurity deep dive to check for vulnerabilities, misconfigurations, and exposure.