Sophisticated SharePoint phishing scams trick users with fake document invites

A new wave of phishing attacks is targeting users through Microsoft SharePoint. The scams involve fake document-sharing notifications that appear genuine at first glance. Cybersecurity experts have flagged these as highly sophisticated attempts to steal login details.

The attack starts with an automated SharePoint invitation, directing victims to a real Microsoft login page. This makes the scam harder to spot. Once credentials are entered, users are prompted for a second login—this time on a manipulated page designed to capture their details in real time.

The phishing emails often claim that a known contact has shared a document. However, in at least one reported case, there was no connection between the sender and recipient. The messages are professionally crafted, using translation tools to avoid language errors and forged sender addresses to appear legitimate.

Many of these attempts target companies, leveraging publicly available information or sending invitations at random. The Federal Office for Cyber Security (BACS) has warned that these attacks can bypass two-factor authentication, increasing their danger. While the Federal Office for Information Security (BSI) has not confirmed exact numbers, reports suggest the scams are spreading quickly.

The phishing campaign exploits SharePoint's trusted reputation to trick users into revealing sensitive data. Authorities urge caution when receiving unexpected document-sharing requests. Businesses and individuals are advised to verify sender details before entering login information.