Phishing
Hackers use Microsoft dashboards to bypass email filters in phishing attacks
Attackers are abusing Microsoft’s own services to make phishing emails look legitimate and avoid detection, according to one report. Victims are tricked into installing remote access tools.
Ross Grant3 min read
The short version
Hackers are sending phishing emails that use real Microsoft websites to look more convincing. The emails link to a dashboard that looks like a locked or blurred document. If you click through, you may end up installing software that lets hackers control your computer. This trick can fool both people and email security systems.
What happened?
Hackers reportedly used Microsoft dashboards to host phishing content, starting around 10 September 2026. Victims received emails linking to these dashboards, which displayed blurred documents and prompted them to download a file. If followed, this led to the installation of remote access software controlled by the attackers.
Attackers abuse Microsoft dashboards to trick users
According to TechRadar (opens in a new tab), hackers have been using Microsoft’s own services to make phishing emails look more trustworthy. The campaign reportedly began around 10 September 2026. Attackers created public dashboards using Microsoft accounts, either newly made or possibly stolen. These dashboards were designed to look like blurred documents with a button labelled “Download Reference”.
This tactic is not new. Attackers often use the blurred document trick to make people curious or anxious enough to click. The difference here is that the dashboard is hosted on a real Microsoft domain, which can help the email get past spam filters and make it seem more credible to recipients.
How the phishing attack works
Victims receive an email with a link to what appears to be a legitimate Microsoft site. The dashboard shows a blurred document and a button to download or unlock it. If the victim clicks, they are led through steps that eventually result in downloading and installing ScreenConnect, a legitimate remote access tool. Once installed, this tool gives attackers control over the victim’s machine.
The report says attackers sometimes installed two instances of ScreenConnect and set up scheduled tasks to keep their access. In some cases, one instance was deleted, possibly to make detection harder. The goal seems to be to maintain a persistent presence on the network, even if defenders remove one of the tools.
What could happen next
The researchers who found this attack (Huntress, according to TechRadar) stopped it before the attackers could do more damage, so it is not clear what the final goal was. With remote access, attackers could steal data, deploy ransomware, or commit financial fraud. The use of two remote access tools suggests they were preparing for a long-term attack.
What Microsoft and others have said
At the time of writing, only TechRadar has reported on this campaign. There is no public statement from Microsoft or law enforcement. The details come from security researchers’ observations, but there is no confirmation from primary sources. It is also not clear how the attackers got access to the Microsoft accounts used to create the dashboards.
What you should do
Be cautious with emails that link to documents you are asked to unlock or download, even if the link appears to be from a trusted service like Microsoft. If you see a blurred document and a prompt to download something, treat it as suspicious. Organisations should monitor for unexpected remote access tools like ScreenConnect on their systems and review logs for unusual activity.
The bigger picture
This campaign shows how attackers can use legitimate services to bypass security measures. Email filters often trust links to well-known sites, so attackers abuse these platforms to get into inboxes. This is a reminder that technical defences are important, but user awareness and vigilance are just as critical.
Claimed vs confirmed
- Unconfirmed
Hackers are using Microsoft dashboards to host phishing content and bypass email filters.
Reported by TechRadar, not yet confirmed by Microsoft or authorities.
- Unconfirmed
Attackers installed two instances of ScreenConnect to maintain persistent access.
Based on researcher observations reported by TechRadar; not confirmed by primary sources.
The impact
- Money
- If attackers gain access to company systems, the potential costs could include data theft, fraud, or regulatory fines. Under UK GDPR, fines can reach £17.5m or 4% of global turnover, depending on the breach.
- Reputation
- Being linked to a phishing campaign, even indirectly, can harm trust in Microsoft services. For organisations, a successful attack could damage customer confidence and business relationships.
- Customers
- Victims risk having their computers remotely controlled by attackers, leading to possible data theft or further compromise. Users should be cautious with unexpected document links, even from trusted brands.
Why it matters
Anyone can receive phishing emails, and using trusted brands like Microsoft makes these scams harder to spot. If successful, attackers can gain remote access to your device, putting your data and privacy at risk. Organisations need to be aware that legitimate services can be abused in this way.
How does it work?
Attackers create a public dashboard on a Microsoft service, making it look like a blurred document with a download button. The phishing email links to this dashboard, tricking users into downloading and installing ScreenConnect, a legitimate remote access tool. This gives attackers control over the victim’s computer. Using Microsoft’s own domains helps the emails bypass spam filters.
Key points
- Attackers are abusing Microsoft dashboards to make phishing emails look legitimate.
- Victims are tricked into installing remote access software, giving attackers control.
- Using trusted domains helps phishing emails bypass security filters.
- The campaign’s full impact is not yet known, as it was stopped early.
- User awareness and technical monitoring are both needed to defend against these attacks.
Sources
TechRadar
Reference
