A Scam That Hides Like a Ghost
Security researchers are warning about a new email scam they have nicknamed "ghost phishing," and it is already hitting businesses across the US.
Here is why it earned the name. Normally, your spam filter checks every link in an email before it ever reaches you. If the link leads somewhere dangerous, the email gets blocked. This new scam beats that check. The link leads to a page that looks completely blank to the security tools. The scam itself stays invisible, like a ghost, until a real person opens the page. Then it appears on the screen.
So the email lands in the inbox looking perfectly safe, because as far as your spam filter could tell, it was.
They Don't Even Ask for Your Password
The email itself looks like everyday office mail: a document waiting for your signature, a voicemail to review, a notice that your password is about to expire.
Click the link, and here is the clever part. You are not taken to a fake login page asking for your password. Instead, the page gives you a short code and sends you to the real Microsoft website to type it in.
Everything about that Microsoft page is genuine. But typing in that code is like buzzing a stranger into your building. It tells Microsoft "let this person in," and the scammers now have access to your email, your files, and everything else in your Microsoft 365 account. From there they can read your messages, pose as you to your customers, or send a fake invoice from your own mailbox.
The One Rule to Remember
You do not need to understand the technology. You just need one rule:
No document, voicemail, or shared file will ever ask you to type a code into a Microsoft sign-in page. If an email gives you a code and asks you to enter it to "verify your identity" or open something, it is a scam. Stop, close the page, and let WolfTech know.
Share that rule at your next staff meeting. It takes thirty seconds, and it stops this scam cold.
The Good News
The feature these scammers are abusing is something most businesses never use, and we can simply turn it off. It is a quick change to your Microsoft 365 settings, and once it is off, this entire scam stops working against your company, even if someone clicks.
If you would like us to check whether your business is protected, or help get the word out to your team, contact us and we will take care of it.
