Post by @zackwhittaker@mastodon.social

@zackwhittaker@mastodon.social · last week

Looks like hackers/scammers/asshats are abusing Microsoft's systems to send out crude phishing messages as two-factor emails.

Emails are sent from msonlineservicesteam@microsoftonline[.]com, which is a legitimate Microsoft email used to send out about account notifications, and look like this.

2 media

a screenshot of a real Microsoft email account notification being abused to send spam/phishing messages to users.

Otto Wicherts

@otto_wicherts@mastodon.social · 2 hours ago

@zackwhittaker I don't understand why they don't separate official Microsoft email from the general populace. If you look at SPF, it includes the entire pool Outlook smtp servers. And DMARC is happy with SPF. So anyone with an Outlook email address can apparently spoof official MS email because they're mailing from the correct SPF pool.

Cav

@cav@infosec.exchange · last week

@zackwhittaker I got one those yesterday.

canleaf08 ⌘ ✅加拿大葉子

@canleaf@mastodon.social · last week

@zackwhittaker here, too! Nobody us competent enough anymore. The agent does everything for them.

Claude Flammang

@claude_flammang@dju.social · last week

@zackwhittaker
Emails can be sent with any sender address. You would have to check the metadata to see where they really originated.

Ronago

@ronago@mastodon.social · last week

@zackwhittaker Seems like it isn't just the Windows codebase being run by AI now

J.P. Stewart

@jpsays@mastodon.social · last week

@zackwhittaker Hey now, I got one of these (_same_ use case / example) from Apple's [edit: account update] system as well.

Edit: With receipts. Best I can tell someone signed up for an icloud account and then forwarded it to a ton of others. Any official apple mail thus gets forwarded as spam effectively. Note. I can see two layers of forwarding in the original headers, which I have redacted.

Edit 2: I guess it's a different implication with just contact information updates. But feels related.

2 media