Overview
Nimblr's Cyber Intelligence Team discovered, through honeypots, that cybercriminals are exploiting Microsoft OneDrive to carry out sophisticated phishing attacks. It is a calculated way to evade firewalls and spam filters by leaning on a platform users inherently trust. It is a textbook example of how phishing works: abuse a trusted channel so the message never looks suspicious.
The real-world impact: a compromised account in Sweden
The research identified a phishing campaign running from the Microsoft OneDrive account of a CEO involved in a major Swedish skiing competition. After notifying the organization, our researchers kept monitoring to understand the attackers' scope and methods. This was not a one-off, and you can see how these campaigns escalate in a multi-stage attack we caught.
How the OneDrive phishing attack works
Step 1: Using a trusted platform. Attackers gain access to legitimate Microsoft OneDrive accounts through leaked credentials or earlier phishing, then exploit the trusted Microsoft domain to bypass security filters.
Step 2: Hosting a fake document. Malicious documents disguised as invoices, reports, or proposals are uploaded, and the shareable links look legitimate because they originate from Microsoft's domain.
Step 3: Sending the phishing emails. Emails containing the OneDrive links are sent to contacts harvested from the compromised mailbox, so they appear legitimate and slip past detection systems.
Step 4: Redirecting to a fake login page. Victims land on a realistic Microsoft login page that captures their credentials for account takeover.
3 pointers: strengthen your IT security against OneDrive phishing attacks
1. Trusted isn't always safe. Well-known websites can host malicious content, and attackers exploit that trust to raise their success rate.
2. Enable multi-factor authentication. MFA is one of the most effective defenses against account takeovers. A second verification step can stop an attack even when the password is compromised.
3. Put your security awareness training to use. Treat OneDrive links in unusual emails with caution.Learn the red flags through the post on anti-phishing policies, build the habit with security awareness training, and prepare staff with simulations so they recognize a fake login page before they enter anything.
