More than 31 000 scam emails abusing Microsoft authentication system detected in seven weeks

Over 31,000 phishing emails exploiting Microsoft's authentication system were identified over a seven-week period from August 1 to September 18, 2026, according to cybersecurity researchers. Kaspersky reported the campaign, which involved attackers setting up Microsoft accounts and accessing the Microsoft Entra admin centre to create fraudulent applications and redirect addresses.

These redirects were embedded in emails that appeared legitimate, hoping to trick recipients into clicking and potentially endangering their personal information or devices. Emails were crafted to look like official Microsoft communications, urging users to update account credentials or sign documents electronically. Another technique involved using Microsoft services to hide fraudulent messages within legitimate notifications.

The scam works by creating fake user accounts and adding victims' email addresses as backup contacts in the Microsoft My Account portal, resulting in victims receiving emails containing altered content. Andrey Kovtun, manager of Kaspersky's Email Threats Protection Group, emphasized that these tactics make phishing emails harder to detect since they appear to come from trusted sources.

Kovtun noted that traditional phishing cues are ineffective in these scenarios. The incident underscores how cybercriminals exploit legitimate online platforms to carry out phishing operations aimed at stealing sensitive information or distributing malware. Phishing remains a prevalent form of cybercrime, with attackers often impersonating reputable organizations to steal credentials, financial information, and other sensitive data.