Living off SharePoint: Cross-Tenant "Data Amendment" Phishing Campaign

Tom Maddox@tm4dd0x

•updated Apr 9, 2026•16•0•569

This detection identifies a large-scale phishing campaign utilizing legitimate SharePoint Personal (OneDrive) infrastructure from external organizations to deliver malicious lure documents. By sending notifications via the official no-reply@sharepointonline.com address, the attackers bypass many reputation-based filters and exploit user trust in the Microsoft 365 ecosystem.