New Phishing Scam Targets Popular Cloud Services
Phishing scams are evolving, and Microsoft is warning business owners about a new and sophisticated threat targeting popular cloud services, making SharePoint and OneDrive phishing tools. While these platforms are typically secure, scammers have found a way to exploit them by bypassing privacy settings and infiltrating your organisation’s defences.
How the Scam Works
Here’s how cybercriminals are pulling off this smarter-than-ever phishing scam:
- Stealing Login Credentials
Scammers obtain your cloud storage login details by hacking accounts or purchasing them on the black market. - Planting Fake Files
Once inside your cloud storage, they upload convincing fake files. These might look like legitimate Microsoft 365 login pages or shared documents from trusted colleagues. - Restricting Access to Increase Trust
To seem authentic, scammers configure the file’s privacy settings to “view-only” or limit access to specific people, such as you or your team. This tricks recipients into thinking the file is legitimate since it appears secure and personalised. - Delivering the Trap
You or your employees receive an email or notification from what seems to be a trusted source, prompting you to open the file or click on a link. Doing so could give scammers access to your systems or install malicious software (malware) designed to steal sensitive information or disrupt your operations.
Why OneDrive Phishing Is Dangerous
These phishing attacks are harder to detect because they cleverly exploit the security features of trusted platforms. The consequences can be devastating for businesses:
- Data Breaches: Scammers could access sensitive information, including customer or financial data.
- System Disruption: Malware may infect your systems, causing downtime and operational headaches.
- Reputation Damage: Clients and partners may lose trust if your organisation is compromised.
- Financial Losses: Recovering from an attack can be costly and time-consuming, including potential fines for regulatory breaches.
How to Protect Your Business
Here are actionable steps to safeguard your organisation against this sophisticated threat:
- Raise Awareness Among Employees
- Educate your team about phishing scams and emphasise caution, even with emails that appear to come from trusted platforms.
- Remind them to double-check the sender’s identity by contacting them directly before opening files or clicking on links.
- Implement Multi-Factor Authentication (MFA)
- Ensure all team members use MFA to access cloud services. This adds a second layer of security, requiring an additional verification step, such as a code sent to their phone or email.
- Keep Software and Systems Up to Date
- Regularly update your security software and operating systems to protect against the latest vulnerabilities and threats.
- Strengthen Cloud Security
- Review and tighten your organisation’s cloud settings to limit access to sensitive data.
- Regularly audit user access and remove permissions for inactive accounts.
- Utilise Advanced Email Security Tools
- Deploy tools that detect and block phishing emails before they reach your team. Many email platforms, including Microsoft 365, offer advanced filtering options.
- Encourage Strong Password Practices
- Ensure your team uses complex, unique passwords for each account.
- Regularly update passwords and use a password manager to store them securely.
- Conduct Regular Training and Drills
- Simulate phishing attacks to test your team’s responses and improve their awareness.
- Provide ongoing training to ensure they stay informed about new and emerging threats.
- Prepare an Incident Response Plan
- Have a plan in place to respond quickly if an attack occurs, including isolating affected systems, notifying key stakeholders, and restoring backups.
Nxt Steps
At Nxt Gen IT, we specialise in keeping businesses like yours safe from ever-evolving cyber threats. From security software and training to proactive monitoring and response planning, we can help you stay one step ahead of cybercriminals.
Would you like to protect your business from phishing scams and other security risks?
Get in touch today to we’ll help protect your business.
Ben helps growing businesses turn technology into a driver of performance instead of a barrier. At Nxt Gen IT he works with SME leaders, recruiters, and fast-scaling teams to design solutions that improve reliability, strengthen security, and unlock growth.
With a background in email deliverability and cloud systems, Ben specialises in making sure businesses communicate effectively, keep data safe, and get the most from Microsoft 365. His experience spans solution design, managed IT services, and virtual CIO support, always with a focus on practical outcomes that reduce headaches for business owners.
Ben has supported organisations across the UK, from recruitment agencies struggling with inbox placement to SaaS firms scaling fast, and SMEs needing a trusted partner for their IT. He believes tech is never the end goal: growth is. His role is to make sure technology never gets in the way of it.