We're seeing fake emails that look like a colleague, supplier or client has shared a file through SharePoint or OneDrive, or that a document is awaiting signature. The link leads to a look-alike Microsoft sign-in page. That page is built to steal the signed-in session, which can get past normal MFA.
We've seen this in recent client incidents. We won't name anyone. The email can even come from a real supplier or client whose account was already compromised, so the sender name alone isn't enough to trust the link.
What to watch for
An unexpected "shared a file with you" or "document awaiting signature" email
A Microsoft login page after you click the link
A sender you recognise — that doesn't rule the message out, if their account was hacked
Before you sign in, check the address bar. A look-alike page can look almost identical to the real Microsoft sign-in screen. If you weren't expecting the file or the signature request, pause.
What iHelp IT already covers for managed clients
If you're an iHelp IT managed client, several layers are already in place:
Check Point Email & Collaboration scans Microsoft 365 email and files for malicious links
iHelp IT monitors sign-ins so unusual account activity can be picked up
Email and files are backed up with Dropsuite, so recovery options stay available if something goes wrong
Coverage isn't identical on every tenant, and no single control stops every attack. The safest habit is still not signing in from an unexpected link.
If you already entered your password
Tell iHelp IT straight away on support@ihelpit.com.au or (02) 8213 4225. Reporting it in the first hour makes all the difference.
When in doubt, call the sender on a number you already have — not a number from the email.
Related note
Separately, some delivery to Hotmail and Outlook.com personal addresses has been intermittent since 6 November 2026. See our note: Email delivery issues to Hotmail and Outlook.com since 6 November 2026.
Need a hand?
Not sure about an email? Don't click. Forward it to support@ihelpit.com.au or ring (02) 8213 4225 and we'll check it for you.
The iHelp IT team
