5 ms·
Scammers are abusing an internal Microsoft account to send spam links
- MichaelZuo 4mo agoHow does it work when a genuine microsoft domain is spending out spam? Do other email providers penalize that specific domain only, or all microsoft domains to a tiny degree?
- huflungdung 4mo ago[dead]
- lelandbatey 4mo agoThe domain is Microsoftonline.com Typically it's a mis-placed feature. Something like "send an email alert when a thing happens" and they let you control what goes in the message body as well as who the message should be sent towards. Sounds reasonable on the surface, but without guardrails it lets folks send arbitrary emails from your domain.
- privacyfish 4mo ago[flagged]
- wnevets 4mo agoIs something similar happening with paypal? I've been getting seemly emails from the PayPal domain that are obviously a scam.
- redwall_hp 4mo agoThe ones I've seen from PayPal are basically from sending a large request for money to you, then in the freeform text field for the reason, putting fake "if you believe this is a scam, call [actually a scam number]" text.
- casty 4mo agoI can confirm. Interestingly they actually put a random USDC transaction number from Coinbase which was very close (close enough that I thought it was accurate) of a transaction I actually did on Coinbase at one point. I was so confused so I ended up calling the number but immediately realized once they picked up what was going on. Essentially they got really lucky that my actual transaction amount was close enough to seem plausible. This is a failure on PayPal’s email template that the freeform text field appears just as legit as other items. The text label was something like “Message from Sender”.
- duskwuff 4mo ago> This is a failure on PayPal’s email template that the freeform text field appears just as legit as other items. This is a somewhat common pattern in scams - abusing freeform text fields in emails or other messages to give the impression that a message is coming from a source that didn't intend to send it. Another variant I've seen is malicious URLs linking to search engines which display the user's search terms, e.g. a link to a Microsoft site search with a prefilled search of "YOU HAVE A VIRUS, CALL MICROSOFT SUPPORT 555-1212".
- diego_sandoval 4mo agoPayPal itself is a scam.
- HDBaseT 4mo agoHow so?
- diego_sandoval 4mo agoThe minimum withdrawal is 10 usd or 20 usd, depending on where you'll be withrdrawing it to. You have less than that in your account and won't be using Paypal soon? say goodbye to those 7 dollars. -- Oh, but you can wait, maybe later you'll use those 7 dollars No, if you don't do transactions for 1 year, they charge you a $10 inactivity fee. It’s designed to hold your money hostage and then take it afterward The only reason to use Paypal is that you have no other way of paying for something. Even cryptocurrency is more user-friendly than Paypal. Btw, their conversion rates are awful.
- spike021 4mo agoA while back I had a reservation with a hotel on Booking and I received a phish attempt that came directly via the Booking site domain email and also DMs but "sent" by the hotel. When I looked into it at the time, it seemed less like an issue of hotels specifically having their accounts infiltrated and more like some kind of message/email endpoint on Booking's end was being abused in a similar manner. I'm not sure this is the same type of issue but found this interesting, especially since apparently it's been reported to MS and no action has been taken.
- kay_o 4mo agoI have not seen one of these that wasn't a compromised hotel email or booking account. I have had to "help" a hotel get malware/RATs off their system more than a dozen times as a _guest_
- r1ch 4mo agoI've started to assume that any non-chain hotel is compromised after losing $2k to hackers that completely owned the hotel's email system. Thankfully DMARC made it irrefutable that it was their system at fault and they assumed liability. BEC is shockingly common and difficult to detect until it's too late.
- kay_o 4mo agoNot just BEC, at multiple non-chains I have found keyloggers, card stealers and everything in between. I refuse to use anything but apple pay on an actual payment terminal (or a 3P booker that passes on a virtual card) and no ID scans or copies.
- baxtr 4mo agoHotels should start giving 5-star reviews to their guests I suggest!
- kay_o 4mo agoTBH I can't imagine the trust of letting a guest access their booking computer handling cards and given the admin password for UAC particularly helped their case here ;-;
- weinzierl 4mo agoWho even can be sure microsoftonline.com is legit. Microsoft's domain story is such a mess, I wouldn't be surprised if not even internally they have one complete list of all the domain assets they own. But they are not alone. It is kind of ironic when companies insist that we check the domain to spot spam but are unable publish a list with all domains they officially use to send mail.
- inetknght 4mo ago> unable publish a list with all domains they officially use to send mail That's because people report them as spam, so they hop domains to avoid that.
- saghm 4mo agoOkay, so then they should stop doing stuff like trying to push people to log into Windows with Microsoft accounts instead of offline credentials and then using that as an excuse to send out inane marketing emails that no one wants. "We're doing something shitty as a workaround for the consequences of other shitty things we do" isn't a particularly good reason for not acting so shitty.
- hnlmorg 4mo agoFor a company with as much weight in the industry as Microsoft, it would be trivial to ensure their domains don’t end up on spam lists. Heck, because of outlook.com, they control have the spam lists themselves. The real reason for multiple domains is likely more stupid than that. It’s likely because different teams want to move faster than the whole of Microsoft, so register a domain for their MVP to enable them to prototype like a start up. Because going through the usual hoops with enterprise regarding using their established domains will be a long and torturous process. And before long, their new prototype domain becomes so integrated into their product that adopting it as official is just easier than switching to microsoft.com. I couldn’t say for sure that’s what has happened here. But it’s the story I’ve seen with domain ownership in other enterprises
- hirsin 4mo ago
- ChrisArchitect 4mo agohttps://abnormal.ai/blog/system-notification-abuse-microsoft-phishing https://abnormal.ai/blog/system-notification-abuse-microsoft...
- nippoo 4mo agoI mean, it happened to the FBI... https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/ https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-...
- razakel 4mo ago>The FBI is aware of a software misconfiguration That's not a misconfiguration, that's incompetence. How do these people get hired?
- lachiflippi 4mo agoThat's actually really easy: 1. be government agency 2. pay 30-70% less than private sector companies would for a similar position 3. receive applicants that are 30-70% less competent Bonus: - have 30+ year old systems nobody understands anymore because the team behind them has been dead/retired for a decade - have hiring process handled entirely by out of touch suits - have a revolving door of motivated soon-to-be burnouts mopping up the mess behind the aforementioned regular employees
- Natfan 4mo agoin 2026, by a drunk who gives out whiskey bottles branded with their name
- avazhi 4mo agoPretty apropos and quite ironically encapsulates what Microsoft has turned into over the past few years in particular. Imagine this is some truly errant copilot instance truly embracing its slop destiny. lol
- zbengrac2 4mo agoshocking..
- binaryturtle 4mo agoI'm receiving daily about 20 to 30 spam mails from google servers. I'm sorting them into a separate SPAM folder for the "fun" of it. Who to contact? How to make Google stop? Where to report the abuse of their services? I can't find out. The whole service is basically a big <bleep> off and "we don't want any contact." Maybe I also need to publish some article, so it can be published here on HN? Maybe that could give it some traction for someone at Google to look into it?
- alex_suzuki 4mo agoYou can try: https://support.google.com/mail/contact/abuse?hl=en https://support.google.com/mail/contact/abuse?hl=en I submitted an account that sent phishing emails last week, but I’m told it’s basically a black hole and to not expect anything anything to happen.
- binaryturtle 4mo agoIt's not gmail accounts, but "services" (?) hosted on Google's cloud. Basically I see X.X.X.X.bc.googleusercontent.com addresses in the "Received" header fields, e.g. "22.185.141.34.bc.googleusercontent.com" When doing a WHOIS on that IP we'll get a contact address for abuse reports: "google-cloud-compliance@google.com", but sending anything there, returns an error that the user doesn't exists.
- currysausage 4mo agoYeah, I fell into that rabbit hole once. Tried all abuse channels that I could find. network-abuse@ refers you to the Google Cloud abuse form. They ‘are not able to take action on this report since the IP mentioned in the report is not hosted on Google Cloud.’ Gmail abuse doesn’t even bother to reply (why should they, it’s not about Gmail after all). In the end, I just blocked DKIM identifiers related to Firebase via Rspamd.
- brandonwindson 4mo ago[dead]
- yard2010 4mo agoDid anyone there try to ask ChatGPT to come up with a solution?
- dminik 4mo agoOn a semi-related note, Microsoft security is genuinely terrible. For the past week, my Microsoft authenticator has been pinging about sign-ins from random places. Except the login history page is completely empty. Not even my own sign ins show up. Now, you would be forgiven for thinking it's because my password leaked, but no. The default sign in flow with the app enabled is email + authenticator. No password required. In their eternal wisdom this option is not changeable in the app. Microsoft really should realize that the only reason the account still exists is because they bought Minecraft and stop complicating my life.
- eterm 4mo agoI've been getting this too, authenticator prompts saying "logged in" and asking for confirmation, but no history whatsoever when I went to security to check. It freaked me out the first time, I went through all the security settings I could find, but it was if it never happened. I just ignored it the second time, but it's a bit unsettling, because the default authenticator flow also has the chance of accidentally hitting the right number.
- e40 4mo agoIs that because it’s two digits?
- eterm 4mo agoNo, because the default is to present you 3 numbers and asks you which your number is! 1 in 3 and easy to hit by mistake.
- wholinator2 4mo agoShouldn't there be a button like "i didn't request this" or something? Why would you hit one of the buttons if you know the request is bogus?
- eterm 4mo ago
- okandship 4mo agobig vendors asking users to inspect domains while spreading mail across unclear domains is part of the problem. publishing a signed, boring source of truth for official sending domains would help defenders a lot.
- zer0tonin 4mo agoI got one of those random 2auth codes email and I assumed my password had been compromised. At least it's some kind of relief to know that it's only a compromised Microsoft email address...
- picsao 4mo ago[dead]
- r1ch 4mo agoMeta had(has?) a similar bug with one of their business manager features, the attacker has complete control of the initial body text which makes it highly convincing. Trying to report this was an exercise in futility, I guess they get so much beg bounty spam that their security submission process filters out the occasional legitimate issue.
- enkrs 4mo agoI've been receiving these for so long I started thinking it must be just me being targeted and not widespread, as Meta seems to not do anything about it. Emails comming legitimeley from noreply@business.facebook.com with the text below. Go and decypher which part is Meta template and which is creative use of user supplied text... Your Meta's Page may be at risk due to unusual activity is not part of or affiliated with Meta. Only approve requests and invitations from people and businesses that you know and trust. Meta will never ask for passwords, payment information or personal details in an email. You've received a partner request. Partners are other businesses that you work with on Facebook. Partner sharing lets you give access to your business assets, but not to your business portfolio. This request is from: Your Page is under restriction review Contact Meta Support: metafanpageviolate@gmail.com Protect yourself from fraud: Verify the identity of the requester by contacting the business using official contact information.
- drdec 4mo agoI feel sad that what I think of as the obvious solution, companies using subdomains like internal.microsoft.com instead of making a million different domains, is so far from happening that no one here on HN has even brought it up.
- kro 4mo agoYou are correct. Reminds me, we once got a letter by a German government body requesting some data exports from our company, and to upload them on findrive-ni.de It turned out to be legit, but it's neither a subdomain of the state of Niedersachsen domain nor referenced in their official sites.
- sieabahlpark 4mo ago[dead]
- dpkirchner 4mo agoHell, they have .microsoft. Why'd they bother?
- kro 4mo agoI've been receiving loads of spam from google MX servers lately until blocking all mails with X-Google-Group-Id headers. I don't know how it's possible, the contents were 100% spammer controlled, no Google template
- sieabahlpark 4mo ago[dead]
- bsoles 4mo agoMy employer's domain starts with "m". Bunch of people recently fell victim for a fishing email whose domain started with "rn". In Outlook 's font the two look almost identical.
- epistasis 4mo agoA keming attack in the wild...
- CSMastermind 4mo agoThis happens all the time, it's a classic phishing tactic.
- hashstring 4mo agoYes, the Outlook sender font is such a joke. They preach about 365 security but don’t practice basics.
- deleted 4mo ago[deleted]
- Chronos74 4mo ago[flagged]
- aftbit 4mo agoI got a coinbase scam from @akamai.com once. One of their acquisitions had a bad SPF I believe.
- ismaelyws 4mo agoDamn. And this completely bypasses any anti-spoofing protection.
- nipperkinfeet 4mo agoThis is a long-standing issue that has persisted for years.
- koliber 4mo agoI own a domain and have a catch all email. I routinely get emails from Microsoft and Google's official email addresses telling me that some account will be closed, or some other account notifications. I never created these accounts, and when I try to log into them or do a password reset, it does not go anywhere. It's been a minor mystery why I keep getting these emails for a while. The Microsoft emails are coming from microsoft-noreply@microsoft.com so it's a bit different than in this article.
- sylware 4mo agomicrosoft IPv4 ranges are filthy of "stretchoid' scanners and script kiddies. Usually, it is better to ban all ms IPv4 ranges. (IPv6 is currently safe... for now...)
- perseusai 4mo agoClassic MS. Even their email service becomes Clippy!