The SharePoint Lure That Never Touched Microsoft

The email announced a scan from a Xerox multifunction device. The graphic inside it showed a Microsoft SharePoint logo, a shield-check icon, the headline "You have got a secure document." and a blue button reading "PREVIEW DOCUMENT HERE." None of that was text. The logo, the headline, the icon, the two-page document thumbnail and the button were a single flat image, and the words on it were only recoverable by running optical character recognition over the pixels.

The one link wrapped around that image did not point at Microsoft, SharePoint, or anything adjacent to either. It pointed at a public share page on Freelo, a real project-collaboration platform. And the page waiting there was not a SharePoint clone. It was a fax notification for two documents that did not exist, from a brand with no connection to the email at all. The scanner rated it clean.

One Image, One Link, No Text to Read

The raw body of this message contained exactly one interactive element: a base64-embedded image wrapped in a single link. No paragraph text, no styled button markup, no visible URL label, no attachment. Everything a content filter would normally read had been rasterized.

That matters more than it sounds. Keyword matching, brand-term detection, urgency-language scoring and anchor-text-versus-href comparison all need characters to operate on. Strip the characters and those controls report nothing at all, not a low score. Optical character recognition is what puts the words back, and here it did: the platform's OCR pass pulled "You have got a secure document." and "PREVIEW DOCUMENT HERE" straight out of the graphic, which is how the lure text became analyzable at all.

MITRE ATT&CK tracks the delivery mechanism as spearphishing link, with the click itself as user execution of a malicious link. Neither depends on the lure being text, and CISA's phishing guidance is explicit that credential-focused campaigns succeed on presentation rather than payload sophistication. A flat graphic is very good presentation: it renders identically everywhere and leaves nothing behind to parse.

Three Brands, One Chain, No Consistency

Follow the brand identity through this attack and it changes twice.

The subject line sold a scanned document from an office multifunction device. The image sold a Microsoft SharePoint secure-document notification. The landing page, once loaded, announced two new fax documents waiting, listed a page count and a PDF format and a delivered status, and offered a link reading "GET YOUR FILES HERE." Three unrelated brand pretexts inside one chain, and no Microsoft-controlled domain anywhere in it.

The hosting choice is the part worth internalizing. The attacker used the generic public share-link feature of a legitimate multi-tenant collaboration product, the same class of abuse the series has documented against Trello, DocuSign, Adobe Sign and SendGrid. That yields a reputable domain, a valid certificate, no fresh-registration signal to age-check, and a URL path that looks like ordinary business collaboration. Domain-reputation logic that would flag a two-day-old lookalike has nothing to say about a shared link on a working SaaS product. The scanner in this case did fetch the page, screenshot it, and mark the URL clean.

MITRE files the sender side under compromised email accounts, and the pattern generalizes: infrastructure the attacker never had to build cannot be blocked on ownership. What sits past the "GET YOUR FILES HERE" link was never captured, so the honest description stops at the notification page. Our Adaptive AI labeled the campaign credential theft, which is where that path usually ends, but the final stage was not observed.

See Your Risk: Calculate how many threats your SEG is missing

The Authentication Verdict Blamed the Wrong Hop

The results delivered to the mailbox looked damning: SPF fail, DKIM signature did not verify, ARC fail, DMARC none, composite authentication none. Read them at face value and you conclude a spoofed sender.

Read the hop chain instead and the story inverts. At the true origin hop, closest to the sender, the message passed SPF, passed DKIM against the sending domain, and passed DMARC. The sending IP sat inside a Microsoft 365 outbound range that the domain's own published SPF record explicitly authorizes. The domain was registered in 2011, roughly fifteen years old, with clean registrar status.

The failures appear only after the message transited the receiving organization's own inbound Cisco IronPort secure email gateway. That relay's IP is not in the sending domain's SPF record, and the retransmission altered the message enough to invalidate the signature. The failing verdict describes the recipient's own mail plumbing, not the attacker. Anyone triaging on authentication alone would chase a spoofing theory that never existed, while the message arrived with a trusted-transport score that pushed it past filtering.

The correct read is worse than a spoof. A genuine, well-aged, fully authenticating nonprofit mailbox sent this, self-addressed with the real recipients almost certainly on BCC, which is the signature of a hijacked account rather than an impersonation. That organization is a victim here too. As RFC 9989 makes clear, DMARC evaluates domain alignment, never sender intent, and NIST's definition of phishing rests on deception rather than forgery. The 2026 Verizon Data Breach Investigations Report puts credentials in play across 39% of breaches and ties 62% of breaches to the human element, which is exactly the loop this attack closes: stolen access at one organization becomes trusted delivery into the next.

Reading the Signals the Verdict Buried

Themis scored the message at 89% confidence and tagged it as both an image-based attack and credential theft, then the platform automatically resolved it as phishing and remediated it out of two mailboxes post-delivery, without an analyst opening the case.

The signals that carried that verdict were not text-based, because there was no text. A body whose entire visual payload is one image wrapped in one link is itself anomalous. The OCR'd wording asserts a secure-document workflow while the only destination is an unrelated collaboration platform, a brand-to-destination mismatch no keyword rule would surface. The subject describes a scanner while the graphic describes SharePoint, a mismatch visible before anyone clicks. First contact from this sender, self-addressed headers, and an inbound path that mangled its own authentication all add weight. Weighed together, the message is hostile even though the URL scan was clean and the brand assets were pixel-accurate.

That is also why credential-harvesting defense and URL and payload analysis have to keep evaluating a link's content at click time rather than trusting a reputation verdict recorded earlier. Page content on a shared SaaS link is editable after the scan.

Indicators of Compromise

MITRE ATT&CK Mapping

• T1566.002, phishing via spearphishing link, delivered as a single-image call to action
• T1586.002, compromise accounts via email accounts, the hijacked nonprofit mailbox used for authenticated delivery
• T1204.001, user execution of a malicious link, the only interactive element in the message

The Takeaway

Two habits fail together here. Assuming a brand-styled lure routes through that brand's infrastructure breaks the moment an attacker rents a share link on an unrelated SaaS product, and assuming the authentication result at the mailbox describes the sender breaks the moment your own gateway relays the mail. Check which hop produced the verdict before building a theory on it, treat a clean URL rating as a statement about a domain rather than about a page, and remember that when a lure is nothing but pixels, the only controls left are the ones that judge what a message looks like and how it behaves.