--- title: 'Common Tricks for Hijacking Microsoft 365 Accounts' url: 'https://blog.datum-consulting.com/blog/microsoft-365-hijacking-tricks' markdown: 'https://blog.datum-consulting.com/blog/microsoft-365-hijacking-tricks.md' date: '2020-07-08' description: 'The current surge in remote working has raised cybercriminal interest in Microsoft 365 (formerly Office 365), one of the most common cloud collaboration platforms. The basic scheme is simple: Cybercriminals lure a company employee to a fake Microsoft 365 login page and persuade them to enter creden…' taxonomy: category: - blog tag: - cybersecurity - 'cyber criminal' - 'microsoft office 365' - 'microsoft teams' - phishing month: - July archives_month: - jul_2020 archives_year: - '2020' --- # Common Tricks for Hijacking Microsoft 365 Accounts [ Home ](https://blog.datum-consulting.com/) Common Tricks for Hijacking Microsoft 365 Accounts ## [Common Tricks for Hijacking Microsoft 365 Accounts](https://blog.datum-consulting.com/blog/microsoft-365-hijacking-tricks) 8th Jul 2020 [cybersecurity](https://blog.datum-consulting.com/tag:cybersecurity#body-wrapper) [cyber criminal](https://blog.datum-consulting.com/tag:cyber%20criminal#body-wrapper) [microsoft office 365](https://blog.datum-consulting.com/tag:microsoft%20office%20365#body-wrapper) [microsoft teams](https://blog.datum-consulting.com/tag:microsoft%20teams#body-wrapper) [phishing](https://blog.datum-consulting.com/tag:phishing#body-wrapper) The current surge in remote working has raised cybercriminal interest in Microsoft 365 (formerly Office 365), one of the most common cloud collaboration platforms. The basic scheme is simple: Cybercriminals lure a company employee to a fake Microsoft 365 login page and persuade them to enter credentials. In other words, it is phishing. The specific methods by which the attackers try to get usernames and passwords differ, but here are the most common tricks of the trade. ##### Fake Teams messages As a rule, when attackers send an e-mail message meant to look like a Microsoft Teams notification, they stress urgency, hoping the recipient won’t take a minute to note any irregularities. So, the general thrust may be something about an urgent deadline, for example, leading the victim to click the *Reply in Teams* button and end up on a fake login page. ![](https://blog.datum-consulting.com/blog/microsoft-365-hijacking-tricks/Teams.jpg "Fake Teams message. Letter and login page.")Fake Teams message. Letter and login page. If the attackers did their homework, the name and picture of a real colleague will be in the notification, which might look something like an internal business e-mail compromise (BEC), but more commonly, it will be some abstract person. The cybercriminals’ calculation is also that the victim’s anxiety about someone unfamiliar having such an urgent matter will force a click on the button. ##### Delivery failure notification Another fake problem crafted to instill a sense of urgency in the recipient is an alleged delivery failure, for example due to an authentication error. In this case, the victim was meant to click through to pick up a message, but the attackers were lazy and failed to create a plausible Microsoft 365 login page. ![](https://blog.datum-consulting.com/blog/microsoft-365-hijacking-tricks/pending-messages.jpg "Fake delivery failure notification. Letter and login page.")Fake delivery failure notification. Letter and login page. Of course, next time they might make a more convincing fake, in which case the recipient would have to fall back on other means of identifying phishing. It’s worth noting that senders, not recipients, get delivery failure notices — if the server were able to identify the intended recipient, then it would deliver the message properly! ##### Full mailbox notification Warning a victim of dire consequences — in this case, the horrible prospect of an undelivered message — the full mailbox notification is simply another aspect of herding workers into a panicked error. The choice it presents is to delete or to download the messages. Most people will opt for the latter and click the bait, a “Click here” button. ![](https://blog.datum-consulting.com/blog/microsoft-365-hijacking-tricks/quota-exceed.jpg "Fake full mailbox notification. Letter and login page.")Fake full mailbox notification. Letter and login page. Note that in this case the attackers made some effort, inserting a paragraph in the е-mail about the company’s social responsibility in light of the pandemic, although they didn’t bother with even minimally convincing business English. Again, reacting out of panic can cause people to overlook the signs of a fraudulent communication. ##### Password expiry notification Changing a password is a fairly common procedure. Your company policy should require it regularly, and security may request it as a precaution against a possible leak. And, of course, when you set a new password, you have to provide the old one. Therefore, password-change requests are a staple of phishing е-mails. ![](https://blog.datum-consulting.com/blog/microsoft-365-hijacking-tricks/password-expired.jpg)Even if you somehow miss the sloppy language in the е-mail, the login page doesn’t stand up to scrutiny. ##### How to avoid getting hooked Remember that account details unlock not only the ability to send е-mails from an employee’s address, but also access to all information accumulated in the mailbox. Any page requesting work account credentials deserves scrutiny, even if — especially if — you’re experiencing pressure to get things done fast. Two essential pieces of advice are all you need, here: 1. Always check the address of any page asking for credentials. Depending on the service, legitimate login pages might include microsoftonline.com, outlook.office.com, onmicrosoft.com, or your company domain name. 2. Deploy a robust security solution company-wide that blocks such phishing е-mails. Contact [Datum Consulting](tel:4144318726) today to find out how we can help your business stand strong in the face of ever-changing cyber threats. [ Previous Post](https://blog.datum-consulting.com/blog/cybersecurity-risk-assessment) [Next Post ](https://blog.datum-consulting.com/blog/out-of-office-messages-dangers) #### Related Posts - 100 [How Hackers Get Your Passwords and How To Defend Yourself](https://blog.datum-consulting.com/blog/hackers-get-passwords "How Hackers Get Your Passwords and How To Defend Yourself") - 100 [How to Keep Your Company Safe from Russian Hacks](https://blog.datum-consulting.com/blog/russian-hacks-safety "How to Keep Your Company Safe from Russian Hacks") - 100 [Data Privacy Week: 6 Best Practices for Your End Users](https://blog.datum-consulting.com/blog/data-privacy-week "Data Privacy Week: 6 Best Practices for Your End Users") - 100 [Cybercriminals To Impersonate Delivery Firms in Black Friday Phishing Scams](https://blog.datum-consulting.com/blog/black-friday-scams "Cybercriminals To Impersonate Delivery Firms in Black Friday Phishing Scams") - 100 [How Cybercriminals Penetrate Corporate Networks](https://blog.datum-consulting.com/blog/common-initial-attack-vectors "How Cybercriminals Penetrate Corporate Networks") [JOIN OUR NEWSLETTER](https://zc.vg/sf/bawK1) [PAY INVOICE ONLINE](https://datum.connectboosterportal.com/authentication/login) [![](https://blog.datum-consulting.com/modules/sidebar/Yubico.png)](https://www.pntra.com/t/SkNJTk5MT09DSEZMTExNQ0dPR0tNSw) #### Follow Us [](https://twitter.com/datumconsulting "Twitter")[](https://www.linkedin.com/company/datum-consulting/ "LinkedIn") "); #### Popular Tags #### Archives - [ 3 May 2022 ](https://blog.datum-consulting.com/archives_month:may_2022) - [ 3 March 2022 ](https://blog.datum-consulting.com/archives_month:mar_2022) - [ 3 February 2022 ](https://blog.datum-consulting.com/archives_month:feb_2022) - [ 2 January 2022 ](https://blog.datum-consulting.com/archives_month:jan_2022) - [ 1 December 2021 ](https://blog.datum-consulting.com/archives_month:dec_2021) - [ 2 November 2021 ](https://blog.datum-consulting.com/archives_month:nov_2021) - [ 2 October 2021 ](https://blog.datum-consulting.com/archives_month:oct_2021) - [ 1 September 2021 ](https://blog.datum-consulting.com/archives_month:sep_2021) - [ 3 August 2021 ](https://blog.datum-consulting.com/archives_month:aug_2021) - [ 2 July 2021 ](https://blog.datum-consulting.com/archives_month:jul_2021) - [ 4 June 2021 ](https://blog.datum-consulting.com/archives_month:jun_2021) - [ 2 May 2021 ](https://blog.datum-consulting.com/archives_month:may_2021) --- ## Navigation - Parent: [Home](https://blog.datum-consulting.com/index.md) - Previous: [The Hidden Dangers of Out-of-Office Messages](https://blog.datum-consulting.com/blog/out-of-office-messages-dangers.md) - Next: [The Value of a Cybersecurity Risk Assessment: Why Your Business Needs One](https://blog.datum-consulting.com/blog/cybersecurity-risk-assessment.md)