SharePoint Renewal Lure Rides a Real Security Gateway

The message announced itself as routine housekeeping. Posing as a notice from SharePoint Online, it told the reader that an alert subscription was about to expire, and that to keep receiving alerts they would need to renew it from the settings page. A single link carried the whole ask. Four mailboxes at a mid-size packaging manufacturer received it, and every one of those links had been quietly rewritten by the company's own security gateway on the way in.

That rewriting is the detail worth sitting with. The links did not point straight at an attacker's page. They were wrapped through Proofpoint URL Defense, the same click-time inspection layer the organization runs on all of its inbound mail. To a person reading their inbox, and to most reputation checks, the wrapper reads as a mark of safety. The company's trusted security vendor had, in effect, put its name on the envelope. Underneath that envelope, the message had already failed every authentication check that exists to prove a sender is who it claims to be.

The lure: a subscription about to lapse

The pretext was small on purpose. There was no attachment and no invoice, only a short notice referencing a shared image file with a camera-style timestamped filename, followed by the line that the alert subscription would expire on a stated date and needed to be renewed through the settings page. The display name read "SharePoint Online," the envelope sender was a no-reply address on sharepointonline[.]com, and a fabricated author byline sat at the bottom. The whole construction leaned on a feeling most people have about notification email, which is that these things expire, and if you ignore them something stops working.

The click destination impersonated a real-looking SharePoint tenant at hxxps://ccccloud[.]sharepoint[.]com, styled as a quality-department site. The credential-harvest surface lived behind that wrapped link. According to the 2024 Verizon Data Breach Investigations Report, the median time from opening a phishing message to clicking its link is roughly 21 seconds, and the median time to then submit data is 28 seconds. A "renew before it expires" hook is engineered to burn through both of those windows before anyone stops to check the sender.

How the message reached the inbox

Here is the mechanism that let a broken email land as if it were clean. The relaying host was Proofpoint-hosted, a genuine node in the gateway's infrastructure, arriving from a Proofpoint-owned address. Microsoft's own filtering saw a message handed off by a trusted relay and assigned it a Spam Confidence Level of -1, the score reserved for mail considered safe enough to skip filtering entirely. The path looked reputable, so the content got a pass it never earned.

This is the same blind spot a legacy gateway model rarely closes on its own: reputation of the delivery path gets treated as a proxy for legitimacy of the sender. If you have ever wondered how much of that gap your current stack leaves open, our email security gap calculator exists to make it concrete. A trusted relay in the header is not the same thing as a sender who authenticated.

Where the authentication actually broke

Strip away the wrapper and the underlying record is unambiguous. At final delivery, SPF failed, because the domain of sharepointonline[.]com did not authorize the sending IP 148[.]163[.]155[.]64. DKIM failed, with the body hash refusing to verify against the signing domains sponaeop[.]onmicrosoft[.]com and sharepointonline[.]com. DMARC failed under a published reject policy, which under the DMARC specification (RFC 7489) should have been an instruction to throw the message away. And the Authenticated Received Chain, the mechanism designed to preserve earlier authentication results across intermediaries, itself failed validation with cv=fail.

There is a wrinkle that makes this case instructive rather than simple. An earlier ingestion hop had recorded SPF, DKIM, and DMARC as passing before the final-hop state collapsed to failure. Authentication is not a single verdict frozen at the door; it can drift as a message transits relays, and the state that matters is the one at final delivery. Reading only the first hop, or trusting a wrapper that vouches for the path rather than the sender, is exactly how a message with a fully broken chain still reaches a person's inbox.

What a trusted wrapper does and does not prove

None of this reflects a failure by Proofpoint. The gateway did its ordinary job, rewriting links for click-time inspection. The point is narrower and more useful: transiting a legitimate corporate security gateway does not repair, launder, or vouch for an email whose sender authentication has failed underneath it. A wrapper proves a message went through a relay. It says nothing about whether the sender is real.

That is why the underlying authentication state has to be read directly. Our Adaptive AI evaluated the final-hop result rather than the reputation of the path, saw SPF, DKIM, DMARC, and ARC all failing on a message impersonating SharePoint Online, and automatically resolved it as phishing across all four affected mailboxes. Broken authentication is a strong, unambiguous signal precisely when everything around it is trying to look trustworthy. Phishing remains present in about 15% of breaches per the 2024 DBIR, and lures like this survive by borrowing credibility they have not earned.

Indicators of compromise

MITRE ATT&CK mapping

• T1566.002 (Phishing: Spearphishing Link). The renewal notice drove recipients to a wrapped link rather than an attachment.
• T1204.001 (User Execution: Malicious Link). The attack depended on a person clicking the "renew" link to reach the credential surface. CISA's phishing guidance covers reducing that click risk at the human layer.

See you next Friday

Similarly themed "Documents" alert messages recurred against other mailboxes at the same organization in the months that followed, which is a reminder that a lure that works once tends to come back. If you want to see how reading authentication at final delivery changes what reaches your people, request a demo.