Navigating the Aftermath of a OneDrive Phishing Attack: What You Need to Do

We’ve all received emails that seem legitimate at first glance, making it easy to fall prey to phishing scams. Recently, I experienced this firsthand and want to share my journey, along with some actionable steps to help anyone else in a similar situation.

The Incident

While awaiting important documents from a supplier, I received an email that appeared to come from OneDrive. Given the context, it wasn’t unusual for me to receive correspondence from a supplier, prompting me to click a link within the email.

Moments later, I received a two-factor authentication code from Microsoft, which further convinced me of the email’s authenticity. Once I accessed the link, I was presented with what appeared to be a contract document. However, clicking a button labeled “click to view contract” redirected me to an unexpected Best Buy website. It was then that I realized something was amiss.

The Aftermath

Realizing that I might have been targeted, I swiftly reached out to the supplier. They confirmed my suspicions: their email account had been compromised by a hacking group based in Paris. Thankfully, they were able to take immediate action and secure their account after I alerted them.

From my understanding, this phishing attempt was likely aimed at compromising my OneDrive or Microsoft account, as well as the accounts of others in the supplier’s contact list. Fortunately, I primarily use this Microsoft account for logging into a Windows 11 virtual machine, so it had limited use.

Taking Precautions

Immediately, I took the following steps to protect my account:

1. Password Reset: I changed my Microsoft account password to a strong, unique one to prevent any unauthorized access.

2. Enhanced Security: I enabled two-factor authentication (2FA) using an authenticator app rather than SMS, adding an extra layer of security.

Given the situation, I have a few questions and concerns that I’d like to address:

• Should I Delete the Microsoft Account?: Considering my limited use of this account, is it wise to entirely delete it to eliminate any lingering risks?

• Reporting the Phishing Attempt: Is there an appropriate channel at Microsoft for reporting the phishing email? Sharing this information could help others from falling victim.

• File Safety Check: Although it seems unlikely that any files were downloaded during this incident, should I conduct a thorough check on my devices to ensure no malware has