Subject: Reginald Dano shared "University faculty application assessment" with you

The Hook: This email is a real Microsoft SharePoint file-share notice sent from a K-12 student account at another organization. However, the document link  is malicious and designed to compromise accounts or credentials.

Image Placeholder

How to Spot the Red Flags:

1. Check the Sender and Banner
The real address is a student account at another school district. The External banner confirms it came from outside.

2. Ask, "Was I expecting this?"
Unexpected files with generic names are a warning sign, even when they look like normal Microsoft notices. Attackers use real services like SharePoint because they pass security checks and look familiar. 

3. Psychological Triggers
Familiarity: It looks like a routine "shared a file" notice. 
Curiosity: The topic is career-related. 
False sense of safety: "This link only works for the direct recipients of this message."

4. Look at the Login Page

Note: Please do not click links in a suspicious email to confirm legitimacy. This is included only to show where the links redirected and to provide further context, if you have believed that a similar email was legitimate to this point.

The page was a Microsoft website, but it showed another organization's logo and the text "Welcome to the FUSD#1 Office user portal." Our own sign-in page would never look like that.
A real Microsoft page doesn't make the email safe. Attackers use real services to pass security checks. This kind of attack can send you from a real page to a fake one that steals your password and MFA code. 

Image Placeholder


Why it's Malicious:

  • It leads to an external sign-in page. Clicking Open takes you to a copy of a Microsoft sign-in page. It uses another district's (FUSD) logo and the text "Welcome to the FUSD#1 Office user portal." Signing in or accepting prompts on an external tenant can expose your account to unauthorized permissions or redirect you to secondary phishing traps

  • It hides behind real services. The email comes from genuine Microsoft SharePoint, so it looks trustworthy and passes normal security checks. A legitimate platform doesn't make the message legitimate.

  • It comes from an abused account. The sender is a student account at another district, most likely misused by an attacker. The message looks like a normal share but wasn't sent for a real purpose.

What should I do if I receive a similar email?

Report it using the Phish Alert button in Outlook


Do not click or open any links or attachments. Do not enter credentials or approve MFA prompts. 
If you already clicked or signed in. Contact IT right away at servicedesk@masters.edu / 661.362.2876.