Fake Microsoft 365 sign-in pages

An email says your password expires today. The sign-in page looks exactly like Microsoft’s — and quietly passes your password and MFA code to an attacker.

What it looks like

Email · IT · Microsoft 365

Your password expires today. Keep your current password by signing in below — it takes 30 seconds.

How it usually ends

The sign-in page relayed everything to the real Microsoft login — your password, your MFA code and your session. The attacker read your mail for weeks.

Red flags

Sign-in page on a non-Microsoft domain, proxying the real one
Your name inside the link
Threat of losing access today

A real case

Tycoon 2FA sold ready-made fake Microsoft and Gmail pages that steal MFA sessions on Telegram, from about USD 120 for ten days (Sekoia, Microsoft).

What to do

Never sign in from a link in an email. Open the portal or app yourself.
Use passkeys or a security key where you can: they don’t work on fake pages.
Report the email to IT, even if you didn’t click.

Could you spot it in the moment?

In Painted Sky you’re born at random somewhere on Earth and live a whole life — and this scam is one of the fakes that can find you. Make the call yourself, then replay the same life with a lens that shows what was fake.

Play Painted Sky — free →