Scammers are abusing an inner Microsoft account to ship spam hyperlinks

For months, scammers have been benefiting from a loophole that enables them to ship spammy emails from an inner Microsoft electronic mail deal with usually used for sending reputable account alerts.

It’s not clear how the scammers are abusing the system, however they’ve been capable of arrange new Microsoft accounts as if they’re new prospects, and use that entry to ship out emails purportedly from the tech large itself, doubtlessly tricking folks into pondering that these emails could also be real.

Microsoft doesn’t but seem to have gotten a deal with on the problem.

Final week, I obtained a number of, equally structured emails containing topic traces and internet hyperlinks to scammy websites from Microsoft throughout completely different electronic mail accounts. These crudely made emails have been despatched from msonlineservicesteam@microsoftonline.com, an electronic mail account that Microsoft makes use of to ship vital notifications to customers, akin to two-factor authentication codes and different vital alerts about their on-line account.

A few of these emails’ topic traces resembled official emails that may alert customers to fraudulent transactions, whereas different emails claimed to have a personal messaging ready for the recipient at an online deal with talked about within the electronic mail physique.

In a social publish on Tuesday, anti-spam non-profit, The Spamhaus Venture, mentioned it had additionally seen Microsoft’s account notification electronic mail deal with being abused to ship spam, and that the exercise dated again “a number of months.”

“Automated notification methods shouldn’t enable this stage of customization,” wrote Spamhaus. The non-profit added that it has notified Microsoft of the problem.

When contacted by information.killnetswitch earlier this week, a Microsoft spokesperson acknowledged our inquiry, however has not but commented or mentioned if the corporate has stopped the abuse of its account notification electronic mail.

That is the newest in a rash of incidents during which hackers or scammers have abused firm methods to trick unsuspecting prospects in latest months. Earlier this yr, hackers broke right into a platform utilized by fintech agency Betterment to ship out fraudulent notifications that presupposed to triple the worth of any crypto customers ship in — a extensively recognized rip-off used to steal folks’s cryptocurrency.

Again in 2023, hackers equally abused entry to an electronic mail account run by Namecheap to ship out phishing emails geared toward stealing folks’s credentials.

Different customers commenting on social media say that different corporations’ electronic mail addresses are additionally getting used to ship out spam, suggesting the problem will not be restricted to Microsoft.