Cybercriminals are reportedly abusing Microsoft’s email infrastructure to send phishing and scam messages that appear to come from official Microsoft accounts. The issue has raised serious cybersecurity concerns because the emails look highly convincing and may trick users into clicking harmful links or sharing sensitive information.

According to recent reports, scammers have been sending deceptive emails through an address associated with legitimate Microsoft account notifications. The emails reportedly originated from msonlineservicesteam@microsoftonline.com, which is commonly used for account verification, two-factor authentication, and security-related alerts. Because the sender address appears genuine, many recipients may mistakenly trust the messages.

The fraudulent emails allegedly contained misleading subject lines warning users about suspicious account activity or claiming they had received a private online message. Some emails included links directing users to potentially dangerous websites designed to steal personal data, login credentials, or financial information. The overall design and formatting reportedly resembled official Microsoft communications, making the scam more difficult to identify.

Cybersecurity organization The Spamhaus Project also highlighted the issue on social media, stating that Microsoft’s notification system had been misused for several months. The organization criticized the apparent loophole and suggested that automated notification systems should not allow such extensive customization by attackers.

Microsoft has acknowledged receiving questions about the reports but has not yet released a detailed public explanation regarding the alleged abuse or confirmed whether the vulnerability has been fully resolved. Security analysts believe attackers may be creating Microsoft accounts and using certain notification features to generate deceptive messages that appear legitimate.

Experts advise users to remain cautious even when emails appear to come from trusted companies. Users should avoid clicking suspicious links, verify sender details carefully, and enable strong security measures such as two-factor authentication. Regularly updating passwords and monitoring account activity can also help reduce the risk of online scams.

More Blogs: Google Play boosts app discovery with Gemini integration and Play Shorts