File-sharing notification phishing: how to check a shared file safely

"Someone shared a file with you" is one of the most ordinary emails at work, which is why phishers love it. Some of these messages are fakes made to look like OneDrive, SharePoint, Google Drive or Dropbox. Others are genuine notifications sent by the real service, from an account the attacker has taken over. This guide explains both, why the second kind gets past filters, and how to check any shared file without clicking the email.

What is file-sharing notification phishing?

It's a phishing email that uses a cloud storage service's "shared a file with you" message as the lure. The goal is nearly always your password and MFA session. CISA's joint phishing guidance names the two main aims of phishing as stealing login credentials and deploying malware, and shared-file lures mostly serve the first.

There are two kinds, and they need different checks.

The fake kind is the classic: a copied template, a "View document" button and a link to a credential-harvesting page. Our guide to fake Microsoft login pages shows what those pages look like and which domains Microsoft really uses for sign-in.

How do attackers abuse real file-sharing services?

Microsoft Threat Intelligence described the pattern in an October 2024 report on campaigns abusing SharePoint, OneDrive and Dropbox. The attack typically starts with "the compromise of a user within a trusted vendor". The attacker then:

1. Signs in to the vendor user's file hosting app with a stolen password or token.
2. Creates a file there, often named after a real shared topic such as "Audit Report 2024", or something urgent such as "Urgent:Attention Required".
3. Shares the file with people at the target organization.
4. Lets the service send its normal notification, with the subject "<User> shared <document> with you".

Microsoft is clear about what that email is: "This email is not a phishing email but a notification for the user about the sharing action." For SharePoint and OneDrive, the share comes "from the user's context, with the compromised user's email address as the sender". For Dropbox it comes from Dropbox's own no-reply address.

The file itself is the trap. In the campaigns Microsoft observed, the recipient had to verify their email address with a one-time code, then saw a document that looked like a preview with a "View my message" link. That link led to an adversary-in-the-middle page that captured the password and the MFA session. The attacker then used the stolen account to run business email compromise and to share the same file onward.

Why these files are hard to scan

Microsoft reported that since mid-April 2024, attackers increasingly made the files hard to analyze:

• Only the intended recipient can open the file.
• The recipient has to re-authenticate first.
• The file is available only for a limited time.
• The PDF is view-only and can't be downloaded.

These restrictions make "detonation and analysis of the sample with the malicious link almost impossible", in Microsoft's words. An email filter sees a legitimate notification with a link to a legitimate service. The malicious link sits one step further on, behind a sign-in.

Why do these emails pass SPF, DKIM and DMARC?

Email authentication proves which domain sent a message. It doesn't prove the content is safe. When Microsoft, Google or Dropbox really sends the notification, it leaves through the service's own mail infrastructure, so it's reasonable to expect SPF, DKIM and DMARC to pass in many cases. The services don't promise this, and results depend on how the message is sent, but authentication isn't what's wrong with these emails. If you open the headers in the Email Header Analyzer, you may well see spf=pass, dkim=pass and dmarc=pass. See how to check whether an email passed SPF, DKIM and DMARC for what each result means.

Two more things help these messages through:

• Reputation. The sending infrastructure belongs to large, well-known services, so the mail doesn't look like it came from a spam operation.
• Allow lists. Microsoft notes that "users from trusted vendors are added to allow lists" in many organizations, so the phishing notification is delivered with fewer checks. Microsoft's own anti-phishing documentation even suggests adding no-reply@sharepointonline.com to trusted senders if SharePoint system messages are flagged as impersonation. That's a reasonable fix for false positives, but it also means those notifications get less scrutiny.

A pass result tells you the notification came from the domain it claims. It tells you nothing about the file, or about whether the person who shared it is still in control of their account.

What are the red flags?

Look at the whole situation, not just the sender address:

• You weren't expecting it. A vendor you haven't worked with in months suddenly shares an "invoice" or "audit report".
• The file name is generic or urgent. "Payment details", "Secure message", "Compromised Password Reset", "Urgent: Attention Required".
• The document is a doorway. It opens to a short preview, a blurred page, or a single button such as "View my message" or "Open secure document".
• It asks you to sign in again. You're already signed in to Microsoft 365 or Google, yet the next page wants your password.
• The sign-in page is on the wrong domain. Check the address bar before you type anything.
• The notification is fake-looking in small ways. The display name says OneDrive, but the address is from an unrelated domain, or the button links somewhere other than the service.
• Many people got the same share. A colleague mentions the same unexpected file. Attackers often share one file with a group of people at the same organization.

Our general guide on how to spot a phishing email covers the checks that apply to every message.

How do you check a shared file safely?

Follow these steps for any shared file you didn't expect:

1. Don't click the button in the email. Leave the message open if you need it, but don't use its links.
2. Open the service yourself. Type the address or use a bookmark: onedrive.com or your SharePoint site, drive.google.com, or dropbox.com.
3. Look in the shared-with-you list. In OneDrive for work or school, that's Shared and then Shared with you. In Google Drive, it's Shared with me. If the file isn't there, the email was fake. Report it and delete it.
4. If the file is there, confirm with the sender. Call them on a number you already have, not one from the email or the file. The FTC's advice is the same for any suspicious message: contact the company "using a phone number or website you know is real".
5. Never enter your password from inside a shared document. A real document doesn't need you to sign in a second time through a link inside it.
6. Report it. Use your mail app's report button and tell IT, especially if the sender is a real business contact. Their account is probably compromised, and they need to know.

Dropbox gives similar advice in its help center: even if a notification really came from Dropbox, "don't view or download a file, or accept a shared folder invitation, unless you know the sender". Dropbox asks you to forward suspicious messages to abuse@dropbox.com.

Blocking repeat shares in Google Drive

Google Drive lets a user block someone from the Shared with me view. According to Google's announcement, the blocked user "will not be able to share any Drive items with you", and you can remove what they already shared. You can't block users inside your own domain, and Google notes there is no admin control for this feature.

What if you already entered your password?

Act fast. In the attack chain Microsoft illustrated, the attacker replayed the stolen token a few hours later:

1. Change your password from a trusted device.
2. Tell IT straight away so they can revoke all your sessions. A stolen session token can keep working after a password change, so the sessions need revoking too.
3. Check for new MFA methods, malicious inbox rules and files shared from your own account.
4. Warn your contacts if your account sent anything.

Our step-by-step guide on what to do after clicking a phishing link covers the full response.

What can admins do?

No single setting stops this attack, because the notifications are real. Combine these controls:

Microsoft 365 sharing settings

In the SharePoint admin center, go to Policies > Sharing. Microsoft Learn lists four levels: Anyone, New and existing guests, Existing guests and Only people in your organization. The OneDrive setting "can be more restrictive than the SharePoint setting, but not more permissive". Under More external sharing settings, Limit external sharing by domain lets you allow or block specific domains.

These settings govern what your users share out. They help stop your tenant being used to phish others if an account is compromised, but they don't stop a partner's tenant sharing a file with you.

Google Workspace sharing settings

In the Google Admin console, go to Apps > Google Workspace > Drive and Docs > Sharing settings > Sharing options. Google's documentation says that when you turn external sharing off, "You can also block external content from being shared with your users, including content in third-party storage systems." That suits organizations that don't collaborate on Drive files with outsiders. The External indicator on externally owned files is on by default; leave it on.

At the mail gateway

An inbound filter can't see behind a sign-in wall, but it can still help. It checks the notification's links and sender reputation, catches the fake kind outright, and lets you hold messages for review instead of delivering them. With iBlockSpam, suspect messages go to each user's quarantine with digest emails, so people can see what was held without opening it in the inbox.

Next steps

• Teach staff one rule: open the service yourself and look for the file. Never sign in from inside a shared document.
• Review your allow lists and remove broad entries for vendor domains.
• Move administrators and finance staff to phishing-resistant MFA first.
• Check your own domain's setup with the free Email Health Check, and protect your contacts from spoofing with DMARC enforcement.
• Read our guides to fake DocuSign emails and vendor invoice fraud, which often follow the same compromised-vendor pattern.