Scammers are abusing an internal Microsoft account to send spam links

Scammers have recently exploited a vulnerability in Microsoft's internal email system, enabling them to distribute spam emails from a legitimate Microsoft account typically reserved for important user notifications. While the exact method of this abuse remains unclear, it appears that these fraudsters are creating new Microsoft accounts to masquerade as genuine customers, thereby gaining access to send misleading emails that could deceive recipients into believing they are authentic communications from the tech giant. Reports indicate that users have received multiple emails from the address msonlineservicesteam@microsoftonline.com, which is normally used for critical notifications such as two-factor authentication codes. The content of these fraudulent emails often mimics legitimate alerts, including subject lines that resemble warnings about suspicious transactions and messages claiming that private communications await the recipients at provided links. The Spamhaus Project, an anti-spam non-profit, confirmed on social media that they had observed the misuse of Microsoft’s email notifications for spam purposes for several months. They criticized the company’s automated systems, stating that such extensive customization should not be permitted, and indicated that they have informed Microsoft about the ongoing issue. When approached for comment, a Microsoft representative acknowledged the inquiry but did not provide further details on whether they have addressed the reported abuse. This incident is part of a larger trend in which hackers and scammers have been leveraging corporate systems to deceive unsuspecting users. Earlier this year, a fintech company faced a similar crisis when hackers infiltrated their platform, sending out fraudulent notifications that promised unrealistic returns on cryptocurrency investments. Additionally, there have been other instances where hackers took control of email accounts from companies like Namecheap, using them to distribute phishing emails aimed at stealing user credentials. With reports indicating that other companies' email addresses are also being misused for spam, it raises concerns about the security of corporate communication systems across the board.