Kaspersky Detects More Than 31,000 Fraudulent Emails Exploiting Microsoft’s Authentication Infrastructure

Kaspersky experts have uncovered a large-scale fraudulent email campaign in which attackers send messages containing legitimate Microsoft service links to redirect users to fake websites or trick them into downloading malware. Kaspersky solutions blocked more than 31,000 emails containing such links between August 1 and September 18.

Earlier this year, Kaspersky reported a phishing campaign in which cybercriminals abused Microsoft’s authentication mechanism. Experts now say attackers are exploiting the same infrastructure using a different lure: emails disguised as official Microsoft notifications that urge recipients to click links under the pretext of updating service access information or signing electronic documents.

To establish the redirection mechanism, attackers first create a Microsoft account and sign in to the Microsoft Entra admin center. They then register a new application through the application registration section. During registration, the system allows users to specify a redirect URI (Uniform Resource Identifier), which determines where users are sent after successful authentication.

Attackers insert the address of their own malicious website into this field. Finally, they send targeted users emails containing Microsoft redirect links that incorporate the registered application’s Application ID and the specified redirect URI.

As a result, users who click these links are redirected to pages designed to steal personal information or download malware.

Example of a phishing email

Attackers have also discovered a way to embed malicious content directly into legitimate notification emails generated by the Microsoft platform through the Microsoft Entra admin center. To do so, they likely purchase the lowest-cost license or initiate a trial subscription.

After inserting a fraudulent message into the name field on the “Overview” page, the scammers create fictitious profiles under the “Users” tab using fabricated email addresses, display names, and passwords. They then sign in to the Microsoft My Account portal using the credentials of one of these newly created fake users and designate the victim’s actual email address—the address used in password reset processes—as a recovery email address.

As a result, the victim receives an unsolicited verification code in their inbox, while the scammers’ fabricated message appears alongside the legitimate notification in the email’s subject and signature sections.

Example of an official email containing an unsolicited verification code and the scammers’ message

Andrey Kovtun, Head of Kaspersky’s Email Threats Protection Group, commented:

“We have seen cases like this before, where fraudulent links and messages are sent not under a company’s name, but through its own official services. This lends the attacks a dangerous degree of legitimacy, making the trap extremely difficult to detect. Since traditional phishing indicators are absent from these messages, it is very difficult for users to identify the danger on their own. We therefore strongly recommend choosing a security solution with robust anti-phishing components that provide automatic protection even against the most sophisticated phishing attempts.”

For organisations to establish a comprehensive line of defence against such complex threats, adopting advanced email security solutions is critical.

For businesses, Kaspersky Security for Mail Server provides robust protection against a broad range of advanced email-borne threats. Its multilayered defence architecture, enhanced by machine learning algorithms, helps organisations maintain business continuity in the face of constantly evolving cyber risks.

For individual users, Kaspersky Premium offers comprehensive protection features designed to help block phishing attacks and strengthen overall cybersecurity. To provide advanced security against increasingly sophisticated threats, Kaspersky is enhancing its consumer solutions with AI-powered scam protection.

This integrated protection architecture combines machine learning-based anti-phishing algorithms, real-time behavioural monitoring, and data breach and identity theft monitoring tools.

About Kaspersky

Founded in 1997, Kaspersky is a global cybersecurity and digital privacy company. To date, the company has protected more than one billion devices against emerging cyber threats and targeted attacks.

Kaspersky’s in-depth threat intelligence and security expertise are continuously translated into innovative solutions and services designed to protect individuals, businesses, critical infrastructure, and governments worldwide.

Its comprehensive security portfolio includes leading digital life protection for personal devices, specialised security products and services for businesses, and Cyber Immune solutions designed to combat sophisticated and evolving digital threats.

Kaspersky helps millions of individuals and approximately 200,000 corporate customers protect what matters most to them.

For more information, visit www.kaspersky.com.

Banner Inside Article - 728x90