- Low-volume credential harvesting campaign observed 20–24 June 2026 abusing Microsoft OneDrive share notifications from a single consumer Outlook account
- Institution-branded Word documents on OneDrive link to zmact[.]us → loq.broadpath[.]us (Cloudflare-protected) → fake Microsoft 365 OAuth sign-in
- Recipient lists show departmental clustering with customized share-notification descriptors aligned to target roles
- Campaign objective: Microsoft 365 / Entra ID credential and session-token theft for mailbox takeover
Threat intelligence
University OneDrive Share Credential Harvesting Campaign
By Hiwot Mendahun and the Mimecast Threat Research Team
Key Points
Campaign Overview
The Mimecast Threat Research team has identified a credential harvesting operation targeting staff and faculty at universities and health-sciences colleges in Australia and the United States. The campaign uses a trusted-service delivery model: messages coming from a OneDrive file-share notification with a display name of "Jesse Lee", while the true SMTP sender is a single individual Outlook account (outlook_024EE0F96AD209F4@outlook.com).
Each wave uses an institution-specific lure document hosted on the same attacker-controlled OneDrive personal tenant (024ee0f96ad209f4). Documents carry the target institution's branding and instruct recipients to open a link presented as a secured SharePoint document. Selecting the link routes victims through attacker redirect infrastructure before presenting a high-fidelity Microsoft sign-in page on a non-Microsoft domain.
Volume remains relatively low consistent with a targeted or semi-targeted operation rather than mass spam. However, the campaign spans multiple institutions, reuses a single sender and OneDrive account, and shows evidence of list metadata injection into notification text.
Campaign Flow
Stage 1: OneDrive Share Notification Email
Recipients receive a message matching Microsoft's standard OneDrive sharing template. The subject line follows the pattern ‘Jesse Lee shared "" with you’. The message body references a Word document named after the target institution.
The notification body includes a secondary descriptor line (e.g. "MSPAS, PA-C, Program Director, Sent you a file") that appears customized to the recipient's cohort.
[Figure 1: OneDrive share notification]
Stage 2: Institution-Branded OneDrive Document
Following the share link opens a Word document on onedrive.live.com under the attacker's personal account. The document reproduces the target institution's logo and states that the organisation has shared a secured document via Microsoft SharePoint. A prominent "OPEN DOCUMENT" hyperlink embeds the credential-harvesting redirect chain.
