Home / Technology / Scammers Hijack Microsoft Emails
Scammers Hijack Microsoft Emails
21 May
Summary
- Scammers exploit a loophole to send spam via internal Microsoft addresses.
- Abuse has been ongoing for several months according to spam experts.
- Microsoft has been notified but has not yet commented on a fix.
For several months, scammers have been exploiting a vulnerability within Microsoft's systems, enabling them to send spam emails originating from an internal Microsoft address. This address is usually reserved for legitimate account alerts, potentially misleading recipients into believing the communications are authentic.
The Spamhaus Project, an anti-spam non-profit, reported observing this abuse for months and has notified Microsoft. The organization highlighted that automated notification systems should not permit such extensive customization, which facilitates the misuse.
This incident follows similar breaches where attackers have abused company platforms. Earlier this year, a fintech firm's platform was compromised to distribute fraudulent cryptocurrency notifications. In 2023, Namecheap experienced a similar phishing attack via its email system. The issue may extend beyond Microsoft, with other companies' email addresses reportedly also being used for spam distribution.
