Small-business owners, if you’ve ever worried about fake invoices slipping through, a new Microsoft 365 phishing scam is escalating the risk by steering users to fake support lines. The attackers use social engineering to lure victims into calling a number and sharing credentials, and they even try to slip through security checks by masquerading as legitimate Microsoft communications.
The campaign, highlighted by Hackread in coverage tied to Guardz, shows attackers sending messages that appear to come from Microsoft 365 but with a twist: they impersonate support staff and provide a phone number to call for help. The emails often use branding that looks authentic and, by leveraging Microsoft infrastructure (including onmicrosoft.com domains), can bypass some common email checks. Details may evolve as this threat unfolds.
What happened
In this campaign, threat actors rely on social engineering rather than flashy malware. The goal is to prompt the recipient to call a fake support line and disclose credentials or authorize actions they shouldn’t. By piggybacking on legitimate Microsoft infrastructure, they can make their outreach look credible and, in some cases, slip past basic email checks that rely on simple indicators like domain spelling.
Guardz notes that the misuse of real Microsoft channels and tenant settings can help attackers produce believable notifications that appear to come from trusted providers. The result is a higher chance of a user engaging with the attacker before security teams can intervene.
Why it matters
- Risk to small businesses: Credential theft, altered access, or unauthorized changes to Microsoft 365 subscriptions can disrupt work and slow operations.
- Risk to IT-minded readers: If attackers can imitate legitimate communications, you need stronger checks at the point of contact and more focus on authentication.
- Practical impact for creators and contractors: A compromised account can affect collaborators, project sharing, and client communications—speed and trust matter here.
Practical steps you can take
- Enable MFA for all users: In the Microsoft 365 admin center, go to Users > Active users, and enable Multifactor Authentication for everyone. This makes it much harder for attackers to use stolen credentials even if a user is tricked into typing them.
- Review recent sign-ins and admin changes: In the Microsoft 365 Defender portal (security.microsoft.com) or Azure AD, check Sign-ins and Audit logs for unusual activity, such as unexpected subscription changes or new admin actions. Look for actions around licensing, billing, or policy changes that you did not initiate.
- Verify communications through official channels: If an email requests action about a purchase, license, or subscription, don’t use any phone numbers or links in the message. Open a new browser tab and navigate to the official Microsoft 365 admin portal or support page to initiate contact.
- Strengthen email defenses: Enable Defender for Office 365 policies and impersonation protection. In the Defender portal, review anti-phishing policies and ensure impersonation protection covers commonly impersonated roles (e.g., Microsoft administrators, vendor contacts).
- Improve DNS email authentication: Add or strengthen DMARC in your DNS (TXT record for _dmarc.yourdomain) with a policy of quarantine or reject, and ensure SPF and DKIM are correctly aligned. This makes it harder for spoofed messages to appear legitimate.
- Run a quick phishing awareness check: Use a simple internal phishing test or awareness reminder for staff, focusing on not calling numbers in unsolicited messages and verifying requests through official channels. A short, monthly reminder can reduce click-throughs and risky behavior.
Final thought
Phishing campaigns are getting more sophisticated by blending familiar branding with social engineering. This particular threat shows why a combination of strong authentication, careful monitoring, and clear verification practices matters for every small business. If you’re unsure about a notification, pause, verify through official channels, and involve your IT team or trusted MSP before taking any action.