Cyber Directorate Warns SharePoint Invoice Phishing Steals Login Codes

Israel’s National Cyber Directorate warned that attackers are sending messages disguised as SharePoint shares for invoices, reports or payment documents. The messages can arrive from compromised mailboxes and appear to come from a known person or organization. Their links open a fake Microsoft sign-in page that asks for account credentials and sometimes an authentication code, potentially allowing attackers to seize the mailbox and send more phishing messages. The directorate advised recipients to verify unexpected documents through another channel, use two-factor authentication and call 119 if they suspect an incident.