Phishing attacks have grown more sophisticated, and attackers are no longer relying on clunky fake emails or obvious scam messages. <\/p>\n
A newly identified campaign shows how threat actors are turning everyday Microsoft 365 tools into weapons, hiding their attacks inside the very workflows employees trust most. <\/p>\n
This is not a flaw in Microsoft\u2019s software but a deliberate abuse of its legitimate features, and that is precisely what makes it dangerous.<\/p>\n
The attack targets Microsoft 365 Groups, a collaboration feature that organizations use daily to coordinate teams, share files, and manage internal updates. <\/p>\n
By taking control of a group and adding victims to it, attackers can slip into a user\u2019s inbox, calendar, and file storage all at once. <\/p>\n
The welcome email looks clean, the group name looks familiar, and nothing immediately raises suspicion.<\/p>\n
Analysts from Fortra\u2019s Intelligence and Research Experts (FIRE) team identified and documented this technique, noting that it represents a shift from traditional phishing toward trusted-workflow abuse.\u00a0<\/p>\n
Fortra\u00a0said in a report<\/a> shared with Cyber Security News (CSN) that the attack is designed to make malicious activity appear as routine collaboration. <\/p>\n Group names such as \u201cIT Support,\u201d \u201cHR Updates,\u201d \u201cFinance Review,\u201d or \u201cAll Company\u201d are crafted to blend in with internal communications.<\/a><\/p>\n Once a user is inside the attacker-controlled group, follow-up content arrives through the group mailbox, shared documents, or calendar invites. <\/p>\n Each step mirrors a genuine Microsoft 365 workflow, which is exactly what keeps users from raising an alarm. The risk becomes real when a user takes action, whether that means clicking a link, opening a file, or responding to a request.<\/a><\/p>\n The potential fallout is significant, as the victims can face credential theft<\/a>, token capture, malware delivery, data exposure, or further social engineering. <\/p>\n Since the attack runs through Microsoft\u2019s own infrastructure, early-stage detection tools may not flag it, giving attackers more time to move through an environment undetected.<\/a><\/p>\n The mechanics of this campaign are straightforward but clever. An attacker creates or controls a Microsoft 365 group and adds the target either by direct addition or through an invite. <\/p>\n The group name and welcome message establish a context designed to feel urgent or routine, such as a payroll update, a mandatory training notice, or a supplier action item.<\/p>\n After the initial group invite, follow-up phishing content<\/a> lands through the group mailbox or shared files. <\/p>\n A document shared inside the group can carry a fake support process, a QR code pointing to a credential-harvesting page, or a macro-laced file. Because that content arrives through a Microsoft collaboration surface, users tend to trust it more than they would a direct email attachment.<\/a><\/p>\n What makes this campaign especially effective is its use of Calendar Phishing, known as CalPhishing. <\/p>\n Once the attacker gains entry through a group invite, a malicious calendar event in .ics format is sent to the victim\u2019s Outlook calendar. That event keeps sending reminders, keeping the phish alive long after the original email may have been deleted or missed.<\/a><\/p>\n The calendar invite can be dressed up as a project meeting, an HR deadline, an admin alert, or an invoice review. Each reminder nudges the user toward taking action over time. <\/p>\n This repeated exposure is what separates CalPhishing from a standard one-time email attack. The phishing hook no longer feels like a scam but like an unresolved work task waiting to be handled.<\/a><\/p>\n Security teams are advised to look beyond the inbox<\/a> when investigating these attacks. Defenders should trace the full chain, covering who created the group, who was added, what files were shared, and whether calendar entries still remain after mail remediation. <\/p>\n Organizations can block the sender domain \u201cgroups.outlook.com\u201d at the gateway level to stop external group notifications. <\/p>\n Employees also need training to treat unexpected group additions and meeting invites with the same caution they would apply to any unsolicited email, especially when the message carries an urgent or administrative theme.<\/a><\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong> Google<\/a><\/strong><\/strong>.<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n The post New Phishing Attack Abuses Outlook and Microsoft 365 Groups Features to Attack Users<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"Phishing](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjDNRoGoCSXYg_GyHMgmgYYOtzk9qxcKv3pcmQf9FPJLJp2TuqT7Q-gtv1GRAcZqer7aVKZcnLxXnORLpyLuqFGzT4b5Ee9goNVBKxSx31baAEMHWeQ9zZPyw6lLVuzN18zc2H1J708iYQC2qdOv-l2iU5R2-gYddflfy1EjqkvCxpkPLhDpyHTOtckZlA\/s16000\/Phishing%2520attack%2520path%2520%28Source%2520-%2520Fortra%29.webp?ssl=1\")
New Phising Attack Abuses Outlook and Microsoft 365 Groups<\/strong><\/h2>\n
![\"Cross-surface](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhWDscKfPmCUEKBwLAZboGyL_qOyOSR-Cmv44uTmQlp8vBx8RsOcnaU2-HuQ5yQH64cQFmI2HbTsNYJsnc0u10kKFOyIxuhRHI3qAn3rpzNl9FZsB5UXqVyXd5nlsjeLbx8nTONkymEuPh4FFDyp7z8LNV6PCaJqUXERvoayTGu-7dg6olYbqizp2K9tk0\/s16000\/Cross-surface%2520visibility%2520map%2520%28Source%2520-%2520Fortra%29.webp?ssl=1\")
CalPhishing: When the Calendar Becomes the Hook<\/strong><\/h2>\n