UMVA has learned that a sophisticated phishing campaign is exploiting a genuine Microsoft email address, turning trusted notifications into dangerous traps.
The malicious messages masquerade as official alerts, yet the links they contain lead to counterfeit login pages designed to steal credentials. Unlike typical spoofing, the sender’s address is authentic, suggesting criminals have hijacked a legitimate notification system.
Hovering over the sender no longer reveals the deception; the address checks out, forcing recipients to scrutinize the email’s content itself. Unusual subject lines, awkward phrasing, and unfamiliar domain links are the tell‑tale signs that the warning is a ruse.
UMVA can exclusively reveal that the safest response is to ignore every link in the suspicious email. Instead, users should launch the relevant Microsoft service directly from the official website or app and verify whether any alerts exist in their account.
If no warning appears on the genuine platform, the email is unequivocally fraudulent. Pressure tactics and urgent calls to action are classic red flags that should trigger immediate caution.
Microsoft has been notified and is actively investigating how attackers managed to commandeer the valid address. The scope of the breach—whether it targets new accounts, specific workflows, or particular notification functions—remains unclear.
