The campaign involves attackers creating Microsoft accounts and accessing the Microsoft Entra admin centre.
Kaspersky experts have identified a new phishing attack trend where elements of spear phishing are being used in bulk campaigns. Picture: iStock
Cybersecurity researchers have identified a phishing campaign that uses legitimate Microsoft services to redirect users to fraudulent websites or distribute malware.
According to Kaspersky, more than 31 000 emails containing such links were blocked between 1 August and 18 September 2026.
Campaign
The campaign involves attackers creating Microsoft accounts and accessing the Microsoft Entra admin centre, where they register applications and configure redirect addresses.
These redirects are then included in emails that appear to contain legitimate Microsoft links.
When users click the links, they may be redirected to websites designed to collect personal information or distribute malicious software.
Emails
Researchers said the emails were disguised as official Microsoft communications and typically urged recipients to update their account credentials or sign electronic documents.
In a separate technique, attackers used Microsoft services to embed fraudulent messages within legitimate notifications.
How the scam works
According to Kaspersky, the method involves creating bogus user accounts and adding a victim’s email address as a backup contact in the Microsoft My Account portal.
This can result in the victim receiving genuine Microsoft verification emails containing content inserted by the attackers.
Tactics
Kaspersky’s Email Threats Protection Group Manager, Andrey Kovtun, said the company had previously observed similar tactics.
“It’s not the first time we have observed that fraudulent links and messages are not sent ostensibly on behalf of the real company, but are sent through official services. This adds a dangerous layer of credibility, making the scam harder to spot.”
Indicators
Kovtun said traditional indicators commonly associated with phishing emails may not be present in such campaigns.
“Traditional phishing cues don’t apply well, so detecting it on your own is difficult.”
The findings highlight how cybercriminals are using legitimate online platforms and services as part of phishing operations aimed at obtaining sensitive information or distributing malware.
Phishing attacks remain one of the most common forms of cybercrime, with criminals increasingly impersonating trusted organisations and using fraudulent emails to steal login credentials, banking details and other sensitive information.
