A Real OneDrive Share Email, Built to Map an Inbox

A message arrived at a public school district that looked like the most routine thing in an inbox: a notification that someone had shared a file. It carried Microsoft's own OneDrive branding, the familiar layout, and a link to open the document. Nothing about it failed a check. SPF passed. DKIM passed. DMARC passed. The mail genuinely came from Microsoft's infrastructure, because the attacker made sure it did.

What made it an attack was not a forged header or a malicious attachment. There was no attachment at all. The whole message was a probe, engineered to quietly answer one question for whoever sent it: which of these mailboxes is live, and who opens their mail?

The notification was real, the intent was not

The sender was an auto-generated-looking outlook.com account, a random string of a local part paired with a fabricated personal display name. It had never corresponded with the district before. From there, the attacker used the feature Microsoft gives every consumer account for free: OneDrive file sharing. They uploaded a file with an innocuous, personal-sounding title, generated a share, and let Microsoft's own systems send the notification email on their behalf.

That is why the authentication story reads so cleanly. The message left outlook[.]com, was signed with a real d=outlook[.]com DKIM signature, and aligned to a header-from of outlook[.]com under a published DMARC policy. Every control a gateway checks returned a pass. The incident record still flagged it as impersonation, because the identity presented to the recipient, a named person sharing a document, had nothing to do with the throwaway account actually behind it.

A share built to reach anyone

Two design choices gave the campaign away as reconnaissance rather than a one-off share.

First, the share permission. The body explicitly stated that the link would work for anyone, and the share was configured that way on purpose. A private OneDrive share forces a sign-in or an access request, which adds friction and creates a record. A public "anyone with the link" share removes all of that. The recipient reaches the destination in a single click, and any forwarded copy stays live for the next person. For an attacker measuring reach, friction is the enemy, and this share was built to have none.

Second, the destination was laundered through Microsoft's own short-link and hosting layer. The visible link was a genuine hxxps://1drv[.]ms short URL, which resolves to a personal share on onedrive.live[.]com. There was no standalone attacker domain to blocklist, no freshly registered lookalike, nothing for reputation systems to score as suspicious. The entire lure ran on first-party Microsoft services, which is precisely what let it sail through every infrastructure-based defense.

The pixel that was the whole point

The reconnaissance mechanism was quieter still. Embedded in the message was a first-party open-tracking callback to r-notifyp.svc[.]ms, part of Microsoft's genuine notification infrastructure. When a recipient's mail client rendered the message, it silently requested that remote resource, and that request confirmed the open back to the sender. No click required. No credentials submitted. Simply viewing the email was enough to mark the mailbox as active and the recipient as someone who engages.

That is the payload here, in the sense that matters. The campaign was not trying to steal anything in this message. It was building a list: which addresses at the district are real, which are monitored, and which people open unexpected shares from strangers. That list is the raw material for a sharper second stage, a credential page or a targeted business-email-compromise attempt aimed only at the mailboxes that already proved they bite.

The follow-on intent showed in the pattern. Near-identical share notifications reached a second mailbox within days, under a different impersonated display name, the signature of a campaign iterating through a target list rather than a single misdirected file.

Why authentication could not catch this

This case is the clean inverse of the usual authentication-failure story. There was no failed SPF, no missing DKIM, no DMARC breach to point at. The 2024 Verizon Data Breach Investigations Report found phishing present in 15% of breaches and the human element involved in 68% of them, and it clocked the median time to click a phishing link at 21 seconds. Numbers like those are why a passive open-tracking probe is valuable: it separates the fast, reflexive openers from everyone else before the attacker spends effort on a real lure.

Detection had to reason about behavior rather than headers. The signals that mattered were contextual: a first-time, randomly-generated outlook.com sender, an impersonated display name with no history at the district, a share deliberately set to public, and a covert open-tracking pixel riding along, all wrapped in a message that authenticated perfectly. Our Adaptive AI weighed that combination and flagged the message as impersonation-driven reconnaissance despite the clean authentication, then correlated the near-identical follow-up so the pattern was treated as one campaign across the affected mailboxes rather than isolated notifications.

What security teams should take away

Treat unsolicited "someone shared a file" notifications from unknown consumer accounts as suspicious even when they authenticate, because riding genuine Microsoft infrastructure is now a standard evasion, not an edge case. Configure clients so remote images do not load automatically, which blunts the open-tracking probe at the source. And recognize that reconnaissance is the first move, not a harmless one: an open confirmed today is a targeted lure tomorrow, which is why layered account takeover protection matters before the second stage arrives. Most of all, measure the gap between what your gateway verifies and what actually reaches your people, because a fully authenticated phish sits squarely inside it. That gap is exactly what our SEG email security gap analysis is built to surface.

Indicators of compromise

Authentication summary: SPF pass, DKIM pass (d=outlook[.]com, s=selector1), DMARC pass under the sender's published policy, header-from outlook[.]com. Impersonation flag set true on the incident record.

MITRE ATT&CK mapping

• T1566.002 (Phishing: Spearphishing Link): delivering a link to a public OneDrive share via a genuine Microsoft notification, giving the recipient a one-click path with no attacker domain to blocklist.
• T1598 (Phishing for Information): using an embedded open-tracking pixel to silently confirm which mailboxes are live and engaged, harvesting targeting data for a follow-on attack.

See you next time

The scariest phishing is not always the message that breaks the rules. Sometimes it is the one that follows every rule, sent from the platform you trust, asking for nothing at all except that you open it. Those quiet probes are worth studying, because the loud attack usually comes next.