SharePoint phishing campaign shows why password resets can fall short

Microsoft reported a multi-stage phishing and business-email-compromise campaign affecting energy-sector organisations in January. The attackers used SharePoint sharing links and compromised identities to make messages appear credible, then expanded phishing within and beyond the affected organisations. The report describes Microsoft’s observations rather than an independently established total of victims.

Researchers said adversary-in-the-middle phishing captured account access and that attacker-created inbox rules helped hide activity. Their remediation guidance included revoking active sessions and removing malicious rules, alongside the account response. Resetting a password alone would leave important parts of that access and concealment problem unaddressed. A legitimate sharing domain or familiar sender therefore did not make the requested authentication trustworthy.