The Moscow-based firm said it blocked more than 31,000 emails containing such links between August 1 and September 18. The cybersecurity firm said the campaign builds on an earlier phishing operation in which attackers abused Microsoft’s authentication mechanism to deceive victims. In the latest campaign, cybercriminals send emails disguised as official Microsoft communications, urging recipients to update their service credentials or sign electronic documents through embedded links. Kaspersky said attackers first create a Microsoft account and use the Microsoft Entra admin centre to register a new application. During registration, they specify a redirect URI, which is the address where Microsoft Entra’s authentication server sends users after successful authorisation.
The attackers then insert the address of a malicious website into the redirect URI field and distribute Microsoft redirect links containing the application ID and the specified URI. As a result, users who click on the legitimate-looking links are redirected to websites designed to steal personal information or download malware. Kaspersky also found that attackers can use Microsoft Entra to embed fraudulent content into legitimate service notifications. The attackers create bogus users with fake email addresses, display names and passwords, then use the Microsoft My Account portal to register the victim’s actual email address as a backup mailbox for password reset messages.
This causes the victim to receive an unsolicited verification code, while the scammers’ fraudulent message appears in the email subject and signature. Kaspersky email threats protection group manager Andrey Kovtun said the use of legitimate services added credibility to the scams and made them harder to detect. “It’s not the first time we have observed that fraudulent links and messages are not sent ostensibly on behalf of the real company, but are sent through official services.
“This adds a dangerous layer of credibility, making the scam harder to spot,” he said in a statement. Kovtun advised users to deploy security solutions with robust anti-phishing capabilities, particularly as traditional phishing indicators may not apply to such attacks. Kaspersky said organisations should also consider email security solutions capable of detecting advanced mail-borne threats as cybercriminals increasingly exploit legitimate platforms and services.
