Convincing SharePoint phishing scams trick businesses with fake login pages

A new wave of phishing attacks is targeting businesses through fake Microsoft SharePoint emails. The scams appear convincing, often mimicking real contacts and legitimate pages. Authorities have noted a rise in reports, warning users to stay alert for suspicious links.

The Swiss Federal Office for Cyber Security (BACS) confirmed an increase in phishing emails linked to SharePoint in early February 2026. These messages look authentic, with no spelling mistakes and professional layouts. Attackers use publicly available data or hacked Microsoft accounts to make the emails seem trustworthy.

The fraudulent links lead to genuine SharePoint pages but redirect victims to fake login forms. Once entered, credentials are stolen—even bypassing two-factor authentication in some cases. Often, there is no clear connection between the sender and recipient, raising further suspicion.

While the German Federal Office for Information Security (BSI) has not recorded specific numbers, Swiss officials report a noticeable uptick in incidents. Companies remain the primary targets, with attackers exploiting trust in familiar platforms.

The phishing campaign highlights the growing sophistication of email scams. Businesses are urged to verify unexpected SharePoint requests and avoid entering credentials on untrusted pages. Authorities continue to monitor the situation as reports rise.