Hackers Posing as Microsoft Officials to Steal Access to Business Email Accounts

Attackers Impersonating Microsoft to Steal Business Credentials

Security researchers have uncovered a coordinated campaign where cybercriminals are pretending to be Microsoft representatives to trick people into handing over their login information. The attackers are sending messages that look like official requests to set up advanced security features for Microsoft 365 accounts. The threat group behind this scheme has connections to China and has been actively compromising email servers at universities across North America to launch these fraudulent requests at scale.

The attackers first break into vulnerable email systems—in this case, older Roundcube servers that institutions haven't fully protected—then use those systems to send convincing fake messages to employees. These messages appear to come from trusted sources and ask recipients to confirm their identity by entering their passwords or other sensitive information. It's similar to someone calling you claiming to be from your bank and asking you to "verify" your account number over the phone.

Why This Attack Method Works So Well

This particular type of scam, known as vishing when done over the phone or through messages, exploits human psychology rather than technical weaknesses. People are naturally inclined to trust official-looking communications about security, especially when they appear urgent. The attackers make their messages look authentic by copying Microsoft's branding, language, and formatting. They also create a false sense of urgency by suggesting that account security requires immediate action.

The use of compromised university email servers makes the attack even more convincing. Instead of messages coming from obviously suspicious email addresses, they originate from legitimate institutional domains that recipients recognize and trust.

The Real Risk You Face

If hackers gain access to your work email account, they can:

• Read confidential emails and steal proprietary information
• Access other connected accounts and services
• Impersonate you to scam your colleagues or clients
• Install malicious software that quietly monitors your computer
• Compromise your organization's entire network

For businesses, a single compromised employee account can become the entry point for attackers to access thousands of records and sensitive systems.

How to Protect Yourself

Verify before you trust: Never click links in unsolicited security requests. Instead, open your Microsoft 365 account directly by typing the address yourself into your browser, or call your IT department's known phone number to confirm whether the request is legitimate.

Watch for red flags: Legitimate companies rarely ask you to confirm passwords through email or chat messages. Microsoft will never ask you to "re-enter" your credentials in response to a message.

Use stronger security: Enable multi-factor authentication on all important accounts. This adds a second verification step that makes stolen passwords much less useful to attackers.

Report suspicious messages: Forward suspicious requests to your IT security team immediately rather than ignoring them.

Stay informed: Keep yourself updated about current scam trends so you can recognize new variations when they arrive.

As organizations increasingly rely on cloud-based services, attackers will continue refining these impersonation tactics, making awareness your strongest defense.