“Someone shared a document with you”

How it works

You get a notice that a document has been shared with you: an invoice, a proposal, a contract to sign, “updated payroll details.” You click to open it, and you are asked to sign in to see it. The sign-in page looks exactly like Microsoft’s. It is not.

Once you type your password, the attackers have it. Some fake pages also capture the sign-in code from your phone, so they get in even with multi-factor authentication.

These emails often come from real accounts that have already been taken over, such as a supplier or client. The attackers use each stolen mailbox to send the same lure to everyone in its contacts. That is why the sender’s name looks right.

What to watch for

• You were not expecting a file from this person, or about this subject.
• The message is vague: “please review,” with no detail only the real sender would know.
• You are asked to sign in again to view a file, when you are already signed in.
• The address bar shows anything other than the real Microsoft sign-in address.

What to do

If you are not sure, contact the sender by phone or in a new message and ask whether they sent it. If you already entered your password, tell your IT provider straight away.