Microsoft 365 is a cornerstone of modern business productivity, trusted by millions of organizations worldwide. However, this very trust is now being exploited by cybercriminals in sophisticated ways. Attackers are leveraging legitimate Microsoft domains and billing notification workflows to deliver emails that evade traditional security controls like DMARC and anti-spoofing. Even more concerning, these attacks often shift the interaction to voice channels, making them harder to detect and prevent.

How Attackers Exploit Microsoft 365’s Trusted Channels

Leveraging Legitimate Microsoft Domains

Attackers create or compromise Microsoft 365 tenants to send emails from real Microsoft domains such as onmicrosoft.com. Because these emails originate from Microsoft infrastructure, they pass all SPF, DKIM, and DMARC checks—appearing authentic to users and security tools alike.

Manipulating Billing Workflows

By initiating real Microsoft 365 billing events (like new subscriptions or trials), attackers trigger genuine Microsoft notifications. They then manipulate metadata or organizational display names to embed fake support numbers or urgent warnings directly into the email. These messages mimic standard Microsoft billing emails.

Moving to Voice Channels

Rather than using links, attackers instruct users to call a phone number for "support" or "fraud prevention." Once on the call, they deploy social engineering to harvest credentials, payment data, or even gain remote access—bypassing email-based security entirely.

Why These Attacks Are So Effective

Bypassing Technical Controls

Emails from Microsoft’s infrastructure evade domain reputation systems and spoofing protection. Security filters see them as legitimate.

User Trust

Since branding, formatting, and the sender’s address match Microsoft’s standards, users are less likely to question the messages.

Voice-Based Social Engineering

Phone-based attacks avoid email monitoring systems and allow real-time manipulation through human interaction.

Real-World Examples

Billing Notification Scams: Fake support numbers embedded into real billing notifications have tricked users into calling attacker-controlled centers.
Customer Voice and Survey Scams: Emails from compromised accounts include fake Microsoft Customer Voice links posing as voicemails or business files.
OAuth Brand Impersonation: Malicious apps mimicking trusted brands are used to steal credentials via OAuth redirection abuse.

What Organizations Can Do

Inspect Metadata: Analyze sender domain properties and organization names for suspicious activity.
Validate Support Numbers: Confirm phone numbers through official Microsoft support channels (https://support.microsoft.com), not just from the email.
Train Users: Educate employees to recognize voice-based phishing and vishing tactics.
Monitor New Tenants: Track emails from unknown or recently created .onmicrosoft.com domains.

Conclusion

The abuse of Microsoft 365’s trusted domains and billing workflows signals a major shift in cyberattack strategy. By operating within Microsoft’s own ecosystem and moving attacks offline to voice channels, attackers are bypassing both technical and human defenses.

To stay protected, organizations must improve metadata inspection, validate support communications, and regularly train users to detect these evolving threats.

How Optimize365.io Can Help

As threat actors continue to innovate, Managed Service Providers (MSPs) need smarter tools to keep pace. That’s where Optimize365.io comes in.

Optimize365 is the platform designed to simplify and automate Microsoft 365 security management for MSPs. Our solution helps you:

🚀 Streamline client’s Onboarding
🔐 Automate and enforce security baselines and user impact prediction
⚠️ Detect drift and misconfigurations
📊 Uncover upsell and revenue opportunities

We reduce manual work, boost efficiency, and give your clients the protection they deserve—at scale.

👉 Start with Optimize365.io today and transform your Microsoft 365 security from reactive to proactive.

Optimize365: Microsoft 365 Security—Simplified for MSPs.

Blog

Critical SharePoint Zero‑Day Exploit: CVE‑2025‑53770 Under Active Attack

EchoLeak (CVE-2025-32711): A Critical AI Vulnerability and Its Impact on MSPs and MSSPs

How to Navigate Microsoft’s July 2025 Patch Flood—And Keep Your M365 Clients Secure

Microsoft Patches Wormable RCE Flaw: What You Need to Know Today

New Microsoft Exchange Server Subscription Edition: What MSPs Need to Know and Why It Matters

Top 5 High-Risk CVEs of June 2025 & How to Patch with Microsoft Updates

Malicious Keylogger Campaign Hits 65 Microsoft Exchange Servers Worldwide

How MSPs and MSSPs Can Automate Microsoft 365 Security Assessments (and Save Hours Every Week)

What the UBS Microsoft 365 Data Breach Teaches Every MSP and MSSP

Microsoft 365 Authentication Woes: What Businesses Need to Know

Microsoft Outlook to Block More Risky Attachments: What It Means for Microsoft 365 Security

Microsoft’s June 2025 Zero-Day: What It Means for Microsoft 365 Security

How Microsoft 365 Billing Workflows and Trusted Domains Are Being Exploited: A New Security Challenge

May 2025 Patch Tuesday: Five Zero-Days Exploited and a Spike in Office Vulnerabilities

Critical Windows Server 2025 dMSA Vulnerability Enables Active Directory Compromise

Microsoft 365 Is Under Attack — What Every MSP Needs to Know and Do Now

CVE-2025-26684: Microsoft Outlook Elevation of Privilege Vulnerability – What MSPs and MSSPs Must Know

Microsoft Outlook Outage May-17: How MSPs Can Stay Ahead of Disruptions and Protect Their Clients

CVE-2025-30397: Windows Privilege Escalation Flaw - Now Exploited - What MSPs and MSSPs Must Do Fast