Microsoft 365 Scam Targets Businesses with Fake Subscription Renewal Notice

A new phishing campaign is targeting Microsoft 365 users, claiming their subscription has expired and that they must renew it immediately to avoid data loss.

The scam emails are designed to look like official Microsoft notices, with a bright warning banner threatening permanent deletion of business data within three days if the subscription is not renewed.

However, clicking on the link takes users through a compromised legitimate webhost before redirecting them to a newly registered phishing domain, where they are asked to enter their payment details.

The fake payment page mimics a Microsoft 365 billing screen, with a plausible monthly charge and a progress sequence designed to hold the victim's attention while their details are captured in the background.