Protect yourself from file‑sharing phishing attacks
We have recently seen an increase in phishing emails that use genuine file‑sharing services such as SharePoint, Dropbox and OneDrive. Because these platforms are part of our everyday work, attackers see them as a useful way to disguise malicious links as something familiar and trustworthy.
This guidance is to help you stay aware of how these attacks work, not to discourage you from using these services.. They remain safe and essential. This guidance is in place to raise awareness of how attackers are adapting their methods, and small habits that help you stay secure.
Why attackers spoof file-sharing services
Cyber criminals know that file‑sharing links look normal and are used every day. They also know that security tools may allow links from trusted platforms, and that people are more likely to click a link if it appears to come from a system the University uses.
This means attackers may send emails that look like they contain a document stored in a legitimate cloud service, but the link may take you to a malicious website instead.
Common signs of a spoofed file‑sharing email
Even if an email looks like it comes from a familiar platform, check for the signs below.
1. Unexpected sharing notifications
If you were not expecting a document, or the subject seems unrelated to your work, pause before you click.
Attackers are now using real Microsoft accounts to share malicious files through SharePoint.
Emails like this will come from [email protected], so you cannot rely on spotting a fake sender address.
Instead, consider the context:
- Were you expecting someone to share a file with you?
- Does the filename or topic seem unusual for your role?
- Is the sender someone you do not normally work with?
A legitimate sender address does not guarantee a safe document. Accounts can be compromised and legitimate services can be misused.
2. Pressure or urgency
Be cautious if the email uses phrases such as “view this immediately” or threats like “your account will be closed”.
Any mention of payroll in an unexpected context is a common red flag.
3. Links that do not match
Hover over the link (without clicking). The URL should match the platform you expect, for example:
https://companyname.sharepoint.com/…
If the link points somewhere unrelated, it is likely phishing.
4. Unusual login requests
If clicking a link takes you to a login page that does not look like the usual Microsoft sign‑in screen, stop straight away.
Important: The Shared File May Appear in Your OneDrive
Although these phishing emails often look like simple SharePoint or OneDrive sharing notifications, be aware that the file may be shared directly with your Microsoft 365 account. As a result, the file may appear in the Shared section of your OneDrive even if you haven’t opened the email or accessed the document; if you don’t interact with the file, your account and credentials remain safe.
Because the file is owned by an external sender, you will not be able to delete it from your OneDrive. However, you can remove it from view by:
- Opening OneDrive.
- Locating the shared file.
- Clicking the three dots (…) next to the file.
- Selecting Hide from shared.
This will remove the file from your shared file list, but the sender may still be able to share other files with your account. As always, do not open or interact with unexpected files and report suspicious sharing notifications to the IT Service Desk.
How to stay safe
You do not need to distrust every cloud link. Just take a moment to check before you click.
1. Pause for three seconds
A brief pause prevents most phishing attacks.
2. Verify the sender
If something feels unusual, ask the colleague or department directly before opening the file.
3. Use the app instead of the email link
Open SharePoint or OneDrive directly:
https://universityofstandrews907-my.sharepoint.com/
Sign in with your @st-andrews.ac.uk email address.
Check if the file appears in your “shared” list.
If it is genuine, it will show there.
4. Report anything suspicious
Use the Report phishing button or contact the IT security team.
You’re not inconveniencing us – it is always better to check.
In summary
Cloud‑based tools like SharePoint and OneDrive are safe and essential, but attackers are becoming more skilled at imitating them. A few simple checks will help protect you and the University.
Thank you for staying alert and helping keep our digital workspace secure.