New SharePoint Phishing Attacks Using Lick Deceptive Techniques

A sophisticated new wave of phishing attacks is exploiting Microsoft SharePoint’s trusted platform to bypass traditional security measures, representing a significant evolution in cyberthreat tactics.

These attacks leverage SharePoint’s inherent legitimacy within corporate environments to deceive users into believing they are interacting with genuine Microsoft services.

The campaigns have demonstrated remarkable sophistication in their execution, moving beyond simple credential harvesting to implement multi-stage validation processes that closely mimic legitimate Microsoft authentication workflows.

The emergence of these SharePoint-based attacks reflects threat actors’ adaptation to increasingly robust email security solutions and extended detection and response (XDR) systems.

Traditional phishing emails containing direct malicious links are now more easily detected by modern security infrastructure, prompting attackers to seek alternative approaches that exploit user trust in established platforms.

Cyberproof analysts identified a significant surge in these attacks throughout recent weeks, noting their increasing prevalence across multiple organizations and their sophisticated evasion techniques.

The attack vectors employed in these campaigns demonstrate a concerning level of technical sophistication.

Attackers are no longer relying solely on simple redirect mechanisms but have developed elaborate multi-step processes that include identity verification phases specifically designed to target intended recipients.

The malicious infrastructure leverages SharePoint’s dynamic hosting capabilities, making detection by automated security tools particularly challenging since the phishing pages are accessible only through specific links for limited timeframes.

Advanced Validation and Authentication Mechanisms

The most technically sophisticated aspect of these attacks lies in their implementation of spear-phishing validation systems that closely replicate legitimate Microsoft authentication processes.

Unlike traditional phishing campaigns that accept generic credentials, these attacks implement recipient-specific validation that prevents unauthorized access to the malicious content.

The system requires users to provide their exact email addresses before proceeding, creating a targeted approach that cannot be bypassed using test accounts or generic usernames.

The authentication flow begins when victims click on SharePoint links embedded in convincing business emails.

These links redirect users to validation pages that request their email addresses, as demonstrated in the attack samples where users encounter prompts stating they must enter their username to proceed to validation pages.

Once the correct email is provided, the system triggers a legitimate Microsoft authentication code delivery to the user’s mailbox, creating an additional layer of deception that reinforces the attack’s apparent legitimacy.

Following successful email validation, users receive authentic Microsoft verification codes in their inboxes, which further convinces them that the interaction is legitimate.

The authentication process culminates when users enter these codes, at which point the SharePoint URL performs its final redirect to attacker-controlled content hosting fake Microsoft login pages.

This sophisticated multi-stage approach makes detection significantly more challenging for security analysts who might only observe the initial SharePoint URL click without recognizing the subsequent malicious redirection chain.

Speed up and enrich threat investigations with Threat Intelligence Lookup! -> 50 trial search requests