The SharePoint Siege: Phishers Weaponize Microsoft's Platform to Bypass 2FA

A new wave of highly convincing phishing attacks is successfully bypassing one of the most trusted security measures in modern enterprise: two-factor authentication (2FA). The technique, which has prompted urgent warnings from national cybersecurity agencies, involves the weaponization of Microsoft SharePoint's legitimate collaboration infrastructure to host malicious credential-harvesting pages. This campaign marks a dangerous evolution in social engineering, directly targeting the global corporate ecosystem.

The attack chain begins with a deceptive email, often impersonating a trusted colleague, internal department, or external partner. The email contains a link that, crucially, points to a genuine Microsoft SharePoint Online domain (e.g., *.sharepoint.com). Because this domain is inherently trusted by email security systems and corporate firewalls, the malicious link easily bypasses standard URL filtering and reputation checks. The victim, seeing a legitimate SharePoint URL, is far more likely to click without suspicion.

Upon clicking, the user is taken to a professionally crafted SharePoint page that perfectly mimics a legitimate Microsoft 365 login portal. The page is hosted on the actual SharePoint service, making its SSL certificate valid and its origin unquestionably authentic from a browser's perspective. The user is prompted to enter their corporate username and password. Here is where the attack innovates to defeat 2FA.

After the victim submits their credentials, the phishing page displays a second prompt, requesting the one-time code from their authenticator app, SMS, or other 2FA method. The user, believing they are on a real Microsoft page as part of a multi-step verification process, often complies. The attackers capture both the static password and the time-sensitive code in real-time. Using automated tools, they immediately inject these credentials into the actual Microsoft 365 login session, gaining full access to the victim's email, Teams, OneDrive, and other connected services before the one-time code expires.

The Swiss National Cyber Security Centre (NCSC) has been particularly vocal in its alerts, noting that this method has led to a significant number of successful account compromises within Swiss government and private sector organizations. The campaign's success lies in its exploitation of inherent trust. Security tools are designed to block links to known malicious domains, but sharepoint.com is not a malicious domain—it's a core business platform used by millions daily. The attack shifts the malicious payload from the link's destination to the content hosted within that trusted destination.

Technical Implications and Defense Shifts:
This attack vector necessitates a fundamental shift in defense-in-depth strategies. Traditional email security gateways that primarily analyze link URLs are insufficient. Organizations must now consider:

1. Enhanced User Training: Employees must be trained to scrutinize authentication prompts, even when they appear on trusted platforms. The key lesson is that a legitimate platform can host illegitimate content.
2. Application-Level Security: Implementing Conditional Access policies in Azure AD that restrict logins from unfamiliar locations, non-compliant devices, or following impossible travel patterns can mitigate the damage even if credentials are stolen.
3. Phishing-Resistant Authentication: The ultimate defense is migrating to phishing-resistant 2FA methods like FIDO2 security keys (e.g., YubiKey) or Windows Hello for Business. These methods use cryptographic challenges that cannot be intercepted and reused by a phishing site.
4. Content Inspection for SaaS: Security solutions capable of scanning and analyzing content within sanctioned SaaS applications like SharePoint for phishing forms are becoming essential.
5. DNS and Network Monitoring: Monitoring for anomalous traffic patterns from endpoints to SharePoint, especially rapid sequences of authentication attempts, can help detect compromised accounts.

The "SharePoint Siege" campaign is a stark reminder that as organizations adopt and trust cloud collaboration suites, attackers are quick to adapt and exploit that very trust. Defending against these advanced Business Email Compromise (BEC) tactics requires moving beyond perimeter-based link blocking to a more holistic approach centered on identity protection, user awareness, and the adoption of unphishable authentication standards.