Original Phishing Message

Where Did The Link Lead?

The link in the phishing email leads to a benign document hosted on Microsoft Sharepoint. Generally, if you see any documents that look like the image below where it asks to “Click Here to view”, it is probably part of a phishing attempt.

Clicking on the “Here” links to a Microsoft Form asking for your email/password combination. Never submit passwords in forms or enter your username/password on sites you do not recognize.

Text of Phishing Message

Subject: Albright Cheryl shared “Docx copy” with you.

Albright Cheryl shared a file with you

FWD: Sabah Randhawa Has shared a File with One Drive

Docx copy [link removed]

This link will work for anyone.

Open [link removed]