Microsoft authentication systems exploited in phishing campaign

Kaspersky security experts have identified a phishing campaign that exploited Microsoft’s authentication systems to target users. Between August 1 and September 18, Kaspersky blocked more than 31,000 malicious emails that utilized legitimate Microsoft service links to bypass standard security filters.

Attackers exploit the Microsoft Entra admin portal by creating new applications and configuring a malicious Uniform Resource Identifier (URI) as the redirect address. When users click on official-looking Microsoft redirect links, the authentication server processes the request normally before sending the victim to a fraudulent website or prompting them to download malware.

Furthermore, scammers have found ways to insert malicious messages into official service notifications. By setting up fake user profiles and adding a target’s email as a backup contact, attackers can trigger legitimate system-generated emails, such as password resets, that contain custom scam messages within the subject line or signature.