Fake File Sharing and E-Signatures: The B2B Phishing Trap

In the modern enterprise workplace, clicking a SharePoint notification, opening a OneDrive link, or signing a DocuSign agreement is an automatic reflex. Employees process dozens of these collaborative requests every week without a second thought. Threat actors understand this dynamic perfectly: they have pivoted away from clumsy spam scams to meticulously clone routine enterprise collaboration workflows.

For CISOs and corporate security teams, this evolution presents an urgent challenge. The line separating legitimate business communications from technical traps has blurred. By mimicking corporate SaaS platforms with pinpoint precision, attackers no longer stop at harvesting passwords: they actively bypass multi-factor authentication by hijacking live session tokens directly from your workforce.

Why Do Fake File Sharing Emails Trick Corporate Users So Effectively?#

Quick Summary: Fake file sharing lures succeed because they replicate legitimate corporate routines and exploit operational urgency. By leveraging compromised cloud tenants to host malicious assets, attackers disarm employee suspicion while easily evading traditional secure email gateways (SEGs).

The success of this tactic relies on contextual social engineering. Threat actors do not need to invent exotic lures: they simply insert themselves into the authentic tools of your daily business ecosystem.

• Pixel-perfect visual mimicry: Enterprise email templates, fonts, official branding, and footer disclaimers from major cloud providers are duplicated down to the pixel. A busy employee recognizes their typical workspace cues and drops their guard.
• Bypassing email security filters: Attackers frequently abuse legitimate, free cloud tiers or compromised enterprise accounts to host intermediary landing pages, such as genuine OneNote or PDF files containing the malicious redirect. Secure email gateways inspect the trusted domain and allow the inbound notification straight into the primary inbox.
• Operational and administrative urgency: Overdue invoices, urgent employment contract amendments, or pre-meeting non-disclosure agreements create immediate pressure to click and review so critical projects do not stall.

AiTM Attacks and Session Hijacking: How Attackers Bypass MFA#

Quick Summary: Adversary-in-the-Middle (AiTM) phishing proxies intercept enterprise credentials and active session cookies in real time. Even when multi-factor authentication is successfully completed by the user, the attacker steals the validated session token to gain direct tenant access without triggering alerts.

For years, deploying multi-factor authentication (MFA) was hailed as the definitive defense against credential harvesting. Against modern AiTM architectures, standard MFA methods fail unless they are specifically designed to be phishing-resistant.

How the Malicious Reverse Proxy Works

When an employee clicks an urgent signature link, they are rarely routed to a static harvesting page. Instead, they hit an automated reverse proxy deployed by the threat actor:

1. The phishing proxy dynamically mirrors the real login screen from the genuine provider (such as Microsoft 365).

2. The user inputs their corporate username and password into this mirrored portal.

3. The genuine identity provider issues an MFA challenge (such as an authenticator push or SMS prompt) to the victim, who validates it normally.

4. The genuine server authenticates the login and issues an active session cookie.

5. The attacker's proxy intercepts this authenticated session cookie in transit, before redirecting the victim to a benign landing page to conceal the breach.

Armed with this authenticated session token, the adversary injects the cookie into their own browser to gain full access to enterprise tools, completely bypassing passwords and standard MFA prompts.

Concrete Habits to Neutralize Collaborative Phishing Attacks#

Purely technical controls cannot fully stop threats that exploit human reflexes within legitimate SaaS environments. Practicing sharp operational habits enables employees to identify and neutralize these attacks on the front lines:

• Scrutinize the final browser URL: While an email notification might appear genuine, the actual domain in the browser address bar reveals the truth. Unfamiliar domains or complex subdomains instantly betray a reverse proxy infrastructure.
• Verify requests out of band: When a trusted vendor or executive sends an unexpected document requiring an immediate signature, verifying the request via a quick phone call or trusted internal chat channel prevents a compromise.
• Implement hardware security keys: Transitioning to FIDO2-compliant physical security keys provides cryptographic protection against AiTM proxies, because the authentication handshake is bound directly to the legitimate web domain.
• Streamline employee reporting channels: Providing employees with a fast, no-blame reporting button allows the Security Operations Center (SOC) to isolate compromised sessions before lateral movement occurs across the corporate tenant.

BRAIN SECURITY PRODUCT IN ACTION · Super Phisher

How to Train Your Workforce Against Real-World SaaS Scenarios#

Theoretical training cannot prepare an employee facing a realistic, high-pressure lure in the middle of a frantic business day. To build durable operational reflexes, confronting realistic and contextualized scenarios is the most effective approach.

This is precisely the mission behind Super Phisher, our simulated phishing campaign platform. Deployed hand in hand with the Brain Security team, this tool lets you evaluate your teams against the latest real-world lures: fake OneDrive file transfers, urgent electronic signature requests, and cloud synchronization alerts. The objective is never punitive; instead, it turns an everyday vulnerability into an immediate, constructive learning opportunity.

Against cybercriminals who weaponize everyday workplace habits, arming your team with both visual discernment and technical vigilance is essential. Talk to our team to build a customized training program tailored to your enterprise toolstack and risk profile.

Further reading: related articles and Brain Security solutions#

Related articles on this topic

• AiTM Phishing: Why Entering a 2FA Code on a Fake Page Steals Your Session (Phishing & Social Engineering) : Discover how AiTM phishing bypasses multi-factor authentication through session cookie theft, and explore actionable defenses to protect your organization.
• Social Engineering on Professional Networks: Fake Job Offers Masking Network Breaches (Phishing & Social Engineering) : Discover how threat actors exploit professional social networks with fake job offers to bypass defenses and compromise enterprise credentials.
• Passwords, Password Managers, and Passkeys: Upgrading Security Without User Friction (Phishing & Social Engineering) : Why drop mandatory 90-day password resets? Learn how NIST and ANSSI guidelines help deploy passphrases and passkeys without slowing down your teams.
• HR Cybersecurity: Spot Weaponized Resumes and AI Deepfake Candidates (Industries & Roles) : Protect your talent acquisition team against weaponized PDFs, malicious portfolios, and live AI deepfake job candidates during interviews.

Explore Brain Security solutions on our website

• Featured solution : Super Phisher : The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.
• Browse use cases by security goal and industry
• Compare our cybersecurity and AI awareness formats
• Explore the full interactive Brain Security catalog
• Discuss your needs with our team (demo and setup)