Scammers are abusing an inner Microsoft account to ship spam hyperlinks

For months, scammers have been making the most of a loophole that permits them to ship spammy emails from an inner Microsoft electronic mail deal with sometimes used for sending reputable account alerts.

It’s not clear how the scammers are abusing the system, however they’ve been capable of arrange new Microsoft accounts as if they’re new prospects, and use that entry to ship out emails purportedly from the tech large itself, probably tricking individuals into pondering that these emails could also be real.

Microsoft doesn’t but seem to have gotten a deal with on the difficulty.

Final week, I obtained a number of, equally structured emails containing topic traces and net hyperlinks to scammy websites from Microsoft throughout completely different electronic mail accounts. These crudely made emails had been despatched from [email protected], an electronic mail account that Microsoft makes use of to ship essential notifications to customers, equivalent to two-factor authentication codes and different essential alerts about their on-line account.

A few of these emails’ topic traces resembled official emails that will alert customers to fraudulent transactions, whereas different emails claimed to have a non-public messaging ready for the recipient at an online deal with talked about within the electronic mail physique.

In a social post on Tuesday, anti-spam non-profit, The Spamhaus Mission, stated it had additionally seen Microsoft’s account notification electronic mail deal with being abused to ship spam, and that the exercise dated again “a number of months.”

“Automated notification methods shouldn’t enable this stage of customization,” wrote Spamhaus. The non-profit added that it has notified Microsoft of the difficulty.

When contacted by TechCrunch earlier this week, a Microsoft spokesperson acknowledged our inquiry, however has not but commented or stated if the corporate has stopped the abuse of its account notification electronic mail.

That is the newest in a rash of incidents wherein hackers or scammers have abused firm methods to trick unsuspecting prospects in latest months. Earlier this 12 months, hackers broke right into a platform utilized by fintech agency Betterment to send out fraudulent notifications that presupposed to triple the worth of any crypto customers ship in — a extensively identified rip-off used to steal individuals’s cryptocurrency.

Again in 2023, hackers similarly abused access to an electronic mail account run by Namecheap to ship out phishing emails geared toward stealing individuals’s credentials.

Different customers commenting on social media say that different firms’ electronic mail addresses are additionally getting used to ship out spam, suggesting the difficulty isn’t restricted to Microsoft.