Fake SharePoint Access Requests Used in New Phishing Scam

Students, faculty and staff are advised to watch for a new phishing scam that abuses Microsoft SharePoint and OneDrive access approval requests. Instead of using malicious links, attackers are sending emails that closely resemble legitimate Microsoft 365 notifications, prompting recipients to approve access to or open a file they were not expecting.

These messages often reference generic or urgent file names such as “Payroll Update,” “Secure Document,” or “Faculty Review,” and may appear to come directly from Microsoft, SharePoint, or OneDrive.

Because they originate from trusted platforms and may not include suspicious links, they can be harder to recognize as phishing.

Why this scam is dangerous

Interacting with these requests can result in credential theft, account compromise, or unauthorized access to CSU systems.

Attackers are taking advantage of Microsoft’s built-in file sharing and approval tools to make these requests appear routine and legitimate.

If you weren’t expecting a file, request, or access approval — don’t click it.

What you should do

Users are encouraged to pause before approving or opening any unexpected SharePoint or OneDrive request and to report suspicious messages using the Report Phishing option in Outlook.

• Do not approve unexpected file access requests
• Do not open unfamiliar shared files
• Report suspicious emails directly in Outlook
• Contact the IT Help Desk immediately if you clicked or entered credentials

Need help?

Anyone who has already clicked or entered their credentials should contact the Division of IT Help Desk immediately:

Email: https://it.csusystem.edu/
Phone: 970-491-7276

More information on how this phishing scam works, what warning signs to look for, and what steps to take is available in the Phishing Alert: Fake SharePoint Access Approval Requests knowledge article.