Most phishing advice tells recipients to check two things before clicking: who sent the message and which domain the link points to. A campaign described by Kaspersky on October 8, 2026 defeats both checks at once, because the emails really do come from Microsoft and the links really do point at Microsoft. Kaspersky solutions blocked more than 31,000 of these messages between August 1 and September 18, 2026, and the company says the same abuse pattern is repeating rather than fading.
The first technique: an application registration with a poisoned redirect
Attackers start by creating a Microsoft account and logging into the Microsoft Entra admin center. In the application registration section they create a new application, and in the redirect URI field, the address where the Microsoft Entra authentication server sends a user after a successful sign in, they enter a link to their own malicious site. They then send out emails containing Microsoft redirect links that carry the registered application ID and the attacker chosen redirect URI.
The result is a link that starts at a genuine Microsoft domain, passes through a real authentication flow, and ends on a criminal landing page that harvests credentials or delivers malware. The lures themselves are ordinary: the messages pretend to be official Microsoft communications urging the recipient to update their service credentials or sign electronic documents.
The second technique: verification emails that carry attacker text
Kaspersky describes a second, equally simple abuse. Fraudsters create bogus user accounts and add a victim’s real email address as a backup contact in the Microsoft My Account portal. Microsoft then sends the victim a genuine, unsolicited verification code email. Because the account or organization name field accepts free text, the attackers write their fraudulent message into that field, and it appears in the subject line and signature of a message that really was sent by Microsoft.
Every technical check passes. The sender is real, the verification code is real, and only the text the attackers typed into a name field is fake. Kaspersky does not describe a software flaw in Microsoft’s platform, and coverage of the findings stresses that this is a standard identity feature used exactly as designed, just for a malicious purpose.
Why DMARC cannot catch this, and why you still need it
Here is the uncomfortable part for anyone who treats email authentication as a complete anti-phishing solution. These messages originate on Microsoft’s own infrastructure and pass SPF, DKIM and DMARC without any forgery. DMARC answers one question: did the message really come from the domain in the From line? It says nothing about whether the sender’s intent is honest. Andrey Kovtun, Email Threats Protection Group Manager at Kaspersky, put it plainly: it is not the first time fraudulent links and messages were sent through official services, which adds a dangerous layer of credibility and makes the scam harder to spot.
That does not make DMARC any less necessary. The attacks that DMARC does stop, direct spoofing of your domain by third parties, remain one of the most common forms of email fraud, and enforcement with quarantine or reject policies remains the only reliable defense against them. The correct reading of this campaign is a division of labor: DMARC guarantees that mail claiming to be from your domain really is from your domain, and human judgment plus layered security has to handle the mail that legitimately comes from big platforms.
What to do about it
For defenders and senders alike, the practical takeaways are direct. Treat any email asking you to update credentials or sign a document with suspicion, even when the link domain looks legitimate, because a trusted domain tells you where a link starts, not where it ends. For security teams, the abuse of Entra application registrations and account recovery flows is a reminder to monitor tenant activity. And for every organization that sends email, the campaign is a reason to double down on what you control: publish DMARC on every domain you own, read your aggregate reports, and enforce your policy, so that your own brand is never the forged identity in someone else’s phishing campaign.
Authentication tells receivers who is really speaking for your domain. Excello Mail turns your DMARC, SPF and DKIM reports into a clear picture of every service sending as your domains, so you can enforce your policy with confidence. Sign up for free to Excello Mail and make sure your domain is never the easy option for fraudsters.