Sophisticated SharePoint phishing scams trick businesses with fake login pages

A fresh wave of phishing attacks is targeting businesses through deceptively real SharePoint emails. These scams use automated invitations that lead to genuine Microsoft login pages, making them harder to spot. Security experts warn that even two-factor authentication may not stop them.

The attacks start with an email claiming a colleague has shared a file via SharePoint. Clicking the link takes users to an authentic SharePoint page, where they enter their credentials. But instead of granting access, the system prompts for a second login—this time on a fake page designed to steal details in real time.

Many of these emails appear professional, with polished translations and forged sender addresses. Some victims report no prior connection to the sender, yet the messages look convincing. The scams exploit publicly available data or send bulk invitations, hoping recipients will assume the request is legitimate.

The Federal Office for Cyber Security (BACS) has logged multiple reports of suspicious SharePoint emails. However, the German Federal Office for Information Security (BSI) has not published any official figures on recent cases. No public warnings or documented incidents from the BSI mention a rise in SharePoint-related phishing over the last three months.

These attacks rely on technical sophistication, tricking users into handing over credentials on cloned pages. Businesses are urged to verify unexpected SharePoint requests before entering login details. Without official confirmation from the BSI, the full scale of the threat remains unclear.