The New Purview‑Abuse Phishing Threat Targeting Your Employees
A new phishing technique is circulating that looks so legitimate it is catching even experienced finance and operations staff off guard.
It arrives as a Protected Microsoft Purview Message, complete with Microsoft branding, authentication prompts, and the familiar workflow employees associate with secure communication.
The problem is that none of that guarantees the message is safe. Attackers have learned how to weaponize Microsoft’s own secure message infrastructure, and the result is a phishing email that feels official, urgent, and trustworthy at exactly the moment it should not.
Let’s look at how the attack works, why it is so convincing, and how employees can recognize the signs before exposing their organization to a threat actor.
How the Phishing Attempt Works
It begins with a compromised Microsoft 365 account
Attackers do not need to compromise Microsoft itself. They only need access to a single Microsoft 365 account inside any organization that uses the platform. That account might belong to a vendor, a contractor, a small business, or an internal department with weaker security controls.
Once they have that access, they can send perfectly legitimate looking encrypted messages from a real Microsoft environment. This is precisely how IT provider blind spots enable advanced phishing – when a trusted vendor’s environment is compromised, your own defenses have no visibility into the threat until it is already inside.
How Attackers Gain Initial Access
Attackers typically gain access through password reuse, MFA fatigue, or by phishing someone in another organization first.
Password reuse gives them an easy entry point when a breached password matches an employee’s Microsoft 365 login.
MFA fatigue works when attackers send repeated approval prompts until the victim finally accepts one.
In many cases, the compromised account belongs to a partner organization. The attacker phishes someone there, gains access to their Microsoft 365 account, and then uses that account to send protected messages to your staff. Because the sender is real, the message passes every technical check.
The email arrives as a standard protected message
The notification looks exactly like the secure messages employees have seen before (or like a message they think they should know exists and won’t ask anyone about because they think they missed something and don’t want to admit it).
It includes Microsoft branding, a “read the message” button, and links to Microsoft documentation. The entire experience is designed to reassure the recipient that this is a legitimate encrypted communication.
The first authentication step is genuine – and intentional
The phishing payload appears only after authentication
Once the message is decrypted, the attacker presents a fake document, a continue button, or a cloned Microsoft 365 login page. This final page is the credential harvesting step. It looks like a routine re-authentication prompt, but the credentials entered here go directly to the attacker.
The attacker now has access to the employee’s account
With valid credentials, the attacker can move quickly. They can read email, reset passwords, intercept invoices, impersonate executives, and initiate internal phishing. At that point, the damage extends well beyond what most organizations expect their IT provider to address – and understanding what your IT provider won’t cover after an attack is critical to knowing where your real exposure lies.
In many cases, this is the first step in a larger business email compromise that can trigger costly insurance claims – and expose gaps in coverage you didn’t know existed.
Why This Attack Is So Effective
It uses Microsoft’s own infrastructure
Because the initial message originates from a legitimate Microsoft 365 account, it bypasses many traditional security controls. The email looks clean, the sender checks out, and the workflow matches what employees expect from a protected message.
Encrypted messages bypass security scanning entirely
Security tools cannot inspect the contents of an encrypted RPMSG file until the user decrypts it. The malicious content is hidden until the employee is already authenticated and engaged.
The experience feels familiar
Employees are trained to trust encryption, Microsoft branding, and secure message workflows. Attackers are exploiting that trust, not trying to break it.
How Employees Can Tell It Is a Scam
Unexpected secure messages are a warning sign
If you were not expecting a protected message, treat it with caution. Most legitimate secure messages are part of an ongoing conversation or a known workflow.
Unfamiliar sender domains should raise suspicion
If the notification comes from a domain you do not recognize or one with no public footprint, assume it may be malicious until proven otherwise.
Urgency and financial pressure are deliberate manipulation tactics
Attackers frequently target:
- Billing departments
- Accounts payable
- CFOs and controllers
- Anyone with financial authority
They use pretexts like invoices, wire approvals, or document reviews – and the message reflects a need to get something done ASAP..
Multiple redirects or repeated login prompts signal credential harvesting
A real protected message typically requires one authentication step. Phishing versions often chain several redirects or ask the user to sign in again after the message is decrypted.
What Employees Should Do Instead
If a protected message seems out of place, the safest approach is simple.
- Do not click “Read the message”
- Log into Microsoft 365 directly. If someone truly sent you a secure message, it will be visible once you are signed in
- Forward the suspicious email to your IT or security team
- Report it to Microsoft at ph***@*****************ft.com
- If you already clicked and entered credentials, notify IT immediately so they can secure your account
Why This Matters for Finance and Business Leaders
This attack is not about curiosity clicks. It is designed to compromise accounts with financial authority. That’s why organizations need governance guardrails that stop phishing escalation before a single compromised account becomes a company-wide incident.
Think about the potential cost of these issues, all made possible with this new threat:
- Invoice fraud
- Payroll redirection
- Vendor impersonation
- Internal compromise
- Data theft
- Full Microsoft 365 account takeover
Finance teams are prime targets because attackers want access to:
- Payment workflows
- Vendor relationships
- Financial approvals
- Sensitive documents
A single compromised account can lead to six‑figure losses – which is why this threat belongs in budget conversations, not just IT discussions.. And if you are assuming your cyber insurance will cover those losses, you may want to read this first: Think Your Insurance Will Cover That Cyber Attack.
How to Protect Your Organization Against Purview-Abuse Phishing
Organizations should prepare employees for this specific threat category. Training should emphasize that encrypted messages are not inherently safe and that authentication alone does not guarantee legitimacy. Technical controls like MFA, conditional access, and behavioral monitoring help, but employee awareness remains the most effective defense.
This is a fast moving threat. As attackers continue to exploit trusted infrastructure, companies must shift from asking whether a message looks legitimate to asking whether it makes sense in context. Understanding how Zero Trust limits credential-based attacks gives finance and business leaders a practical framework for reducing exactly this kind of exposure.
That shift also has direct implications for cyber insurance coverage – insurers increasingly scrutinize whether organizations had MFA, conditional access, and behavioral monitoring in place before a claim is filed.
Understanding how cybersecurity decisions connect to financial projections is the next step in building that broader organizational awareness.
Frequently Asked Questions
How does a Protected Microsoft Purview Message phishing attack actually work?
Attackers gain access to a legitimate Microsoft 365 account, then send encrypted protected messages from that real account. When the employee clicks to read the message, they are taken to a genuine Microsoft login page. Once the message is decrypted, the attacker presents a fake document, a continue button, or a cloned Microsoft 365 login page — and the credentials entered here go directly to the attacker.
How can employees tell if a Protected Microsoft Message is a phishing scam?
If you were not expecting a protected message, treat it with caution. If the notification comes from a domain you do not recognize or one with no public footprint, assume it may be malicious until proven otherwise. A real protected message typically requires one authentication step — phishing versions often chain several redirects or ask the user to sign in again after the message is decrypted.
Why can't security tools catch this type of phishing email before it reaches employees?
Because the initial message originates from a legitimate Microsoft 365 account, it bypasses many traditional security controls. Security tools cannot inspect the contents of an encrypted RPMSG file until the user decrypts it — the malicious content is hidden until the employee is already authenticated and engaged.