Skip to main

Woburn, MA – March 23, 2023 — Kaspersky experts today share they have observed more than 1,600 malicious SharePoint notifications disguised as phishing links in a file on a hijacked SharePoint server. The malicious notifications are being distributed using a native notification mechanism. Such emails are bypassing spam filters as they are deemed legitimate, and there are potential victims in Europe, North America, and other regions. Although this attack has not yet reached a large number of users, organizations should be aware of the new scheme to mitigate future risk. 

Since spam filters are almost always capable of detecting phishing emails with a link in the body of the letter, cybercriminals are constantly refining their tools to try bypassing security solutions. Cybercriminals have evolved their skills from hiding phishing links on a SharePoint server, as in previously known schemes, to now distributing them via legitimate SharePoint notifications. A Kaspersky security solution filtered more than 1,600 malicious notifications between December 2022 and February 2023. Cybercriminals tried to lure data from companies in Austria, France, India, Italy, Japan, the Netherlands, Russia, Singapore, South Korea, Spain, and the U.S.  

How phishing via SharePoint notifications works

An employee receives a standard SharePoint notification saying that someone has shared a OneNote file with them. This email is absolutely legitimate and can bypass the spam filter more easily than a phishing link hidden on a SharePoint server.

An employee follows the link, where the OneNote file mentioned opens, but the body of the note contains another ‘notification’ with a huge icon of a different type of file (for example, PDF) and a standard phishing link.

This phishing link leads to a phishing website that mimics the Microsoft OneDrive login page. Cybercriminals use it to steal the credentials for various email accounts, such as Yahoo!, AOL, Outlook, Office 365, and others.

How companies can mitigate risks against this type of phishing

Although such phishing letters are convincing, they can be distinguished by the array of red flags that can be explained to employees.

"To begin, the file is unknown as well as the sender. This is the first red flag as colleagues don’t normally share documents without an intro,” explains Roman Dedenok, spam analysis expert at Kaspersky.

“Additional red flags include a link to the OneNote file in the notification and PDF-file appears on the server out of the blue. Furthermore, the download link leads to a third-party site, which web address has nothing to do with the victim's organization or SharePoint server. The phishing site mimics login page for OneDrive, which is another Microsoft service that is not related to SharePoint. To stay safe, it is necessary to use caution with all suspicious emails and watch out for such inconsistencies.”

Learn more about phishing with SharePoint notifications on Kaspersky Daily.

To stay protected from various phishing techniques targeting small, medium, and large businesses, Kaspersky recommends implementing the following measures:

  • Use security solutions with anti-phishing technologies not only at the company's mail servers but also on all employees' work devices.
  • Provide your staff with basic cybersecurity hygiene training. Conduct a simulated phishing attack to ensure that they know how to distinguish phishing emails.
  • If using Microsoft 365 cloud service, don’t forget to protect it too. Kaspersky Security for Microsoft Office 365 has a dedicated anti-spam and anti-phishing as well as protection for SharePoint, Teams, and OneDrive apps for secure business communications. 

About Kaspersky

Kaspersky is a global cybersecurity company founded in 1997. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialized security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky technologies and we help 240,000 corporate clients protect what matters most to them. Learn more at


Media Contact:

Cassandra Faro



Kaspersky researchers find legitimate SharePoint notifications used for phishing

Kaspersky Logo