Microsoft: Creative Abuse of Cloud Files Bolsters BEC Attacks

Microsoft Threat Intelligence warns of a rise in sophisticated Business Email Compromise (BEC) campaigns that weaponize trusted cloud file-hosting services (Dropbox, OneDrive, SharePoint). Attackers compromise an initial enterprise account, host restricted or view-only files that bypass email and detonation protections, and lure trusted external recipients to authenticate—redirecting them to adversary-in-the-middle (AiTM) pages that capture credentials and MFA tokens. The compromised identities are then reused for financial fraud, data theft, lateral movement, and to deliver RATs/spyware; Microsoft recommends XDR and identity-focused monitoring to detect anomalous sign-ins and suspicious shared-file campaigns.