Scammer abusing Microsoft's msonlineservicesteam@ for spam distribution

May 24, 2026 · 1:52 AM UTC · 0 reactions · 0 comments · 30 views

Attached: 1 image ❗ We’ve observed a scammer clearly abusing Microsoft's 'msonlineservicesteam@microsoftonline[. ]com' for spam distribution. The header and message body appear completely legitimate - the abuse is happening through injection into the Subject: ✉️ Here's an example: "Your PayPal order for 0.0092 BTC ($699.99) is complete. Not you? Call +1 (803) 237-5050 account email verification code." At this point, it appears the attacker may have simply set the malicious text as either the account name or the organization name. This also appears to line up with what @[email protected] TechCrunch Security Editor identified last week: https://mastodon.social/@zackwhittaker/116562360000833298 ....although the activity we’re seeing appears to stretch back several months. Takeaway: automated notification systems should not allow this level of customization. Microsoft has been informed of this abusive activity. #ThreatIntel #Spam #InfoSec #CyberSecurity

About this source

Hacker News (Newest) files mainly under programming. We currently carry 5,306 of its stories.

All Hacker News (Newest) coverage →

Original article

Infosec Exchange

Read full at Infosec Exchange →

Story provenance

Source · retrieval · rights · ranking — open for full record

inspect →

Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.

Record

Original publisher	Infosec Exchange
Canonical URL	https://infosec.exchange/@spamhaus/116601270466207765
Publication time	Sun, 24 May 2026 01:52:47 +0000
Retrieval time	2026-05-24T02:37:29.540Z
Last seen	2026-05-24T02:37:29.540Z
Headline source	Publisher (no WeSearch rewrite)
Excerpt source	publisher description
Excerpt method	Publisher-supplied description / RSS summary field.
Summary	None yet
Summary source text	description
Citation coverage	No WeSearch summary has been generated for this story yet.
Cluster	A3gQ8j41elI_
Cluster logic	Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison.
Ranking reason	Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking.
Publisher visit	Yes — open original
Substitutes article?	No — link-out required for full text

Rights status (four layers)

Publisher-declared

No publisher-confirmed rights record for this source yet.

Machine-readable

No source-specific machine-readable restriction detected beyond the public feed.

WeSearch interpretation

WeSearch declared handling (basis: Derived from the published RSS/Atom feed). This is WeSearch policy, not a legal grant on the publisher's behalf.

Unknown

Retrieval and training permissions are not asserted unless the publisher confirms them.

WeSearch handling by dimension

Indexing	May the item be indexed (stored, ranked, made findable)?	Allowed
Snippet	May a short excerpt of the publisher's text be shown?	Allowed
AI summary	May WeSearch generate its own short summary of the article?	Limited
Retrieval / RAG	May the content be exposed for third-party retrieval-augmented generation?	Not asserted
Model training	May the content be used to train AI models?	Not asserted
Commercial reuse	May the content be reused commercially?	Not permitted

Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.

Open original publisher → Source rights JSON → Machine-readable provenance → Rights framework → WESEARCH-STORY-PROVENANCE-V1

Anonymous · no account needed

Discussion

0 comments