Scammers are abusing an internal Microsoft account to send spam links

Scammers have been exploiting a loophole in Microsoft's notification system for months, sending spam from an internal email address the company normally uses for legitimate account alerts, TechCrunch reported.

An official address, used for junk mail

The messages came from [email protected] — an address Microsoft uses for important notifications to users, including two-factor authentication codes and other critical alerts about their online accounts. It is not clear how the scammers are abusing the system, but they have been able to register new Microsoft accounts as if they were new customers and use that access to send emails purportedly from the tech giant.

TechCrunch's security editor received several similarly structured emails across different accounts last week. Some subject lines resembled official alerts about fraudulent transactions; others claimed a private message was waiting at a web address given in the body of the email.

Spamhaus says the activity dates back months

Anti-spam nonprofit The Spamhaus Project said it had also seen Microsoft's account notification address being abused to send spam, and that the activity dated back "several months". "Automated notification systems should not allow this level of customization," the organisation wrote, adding that it had notified Microsoft of the problem.

Microsoft's response

Microsoft acknowledged the inquiry when contacted by TechCrunch but did not comment before publication. In a statement provided afterwards, the company said: "We are actively investigating and taking action against these phishing reports to help keep customers protected. This includes further strengthening our detection and blocking mechanisms, while removing accounts that violate our Terms of Use."

The incident fits a pattern. Earlier this year, hackers broke into a platform used by fintech firm Betterment to send fraudulent notifications, a well-known scam used to steal cryptocurrency; in 2023, attackers abused access to an email account run by Namecheap to send phishing messages. Users commenting on social media said other companies' addresses are also being used for spam, suggesting the problem is not limited to Microsoft.