How to fight malicious mail about Office365

Federico Coppola 1,181 Reputation points
2020-10-07T10:25:13.25+00:00

Hi all,
I manage Microsoft Exchange in Office365.
Recently a few group of users notified me that they have received "strange" mail about password expiring.
These mails has got inside a fake button that redirect you to a fake website (I did not try, but I suppose it).
This is an example of this fake mail:

30645-example-fake-password-expired.png

I have seen that source mail address are not the same. Source mail address change.

How can I do to fight this issue?
Thanks for your help!

Federico

Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,576 questions
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,667 questions
0 comments
Accepted answer
  1. KyleXu-MSFT 26,266 Reputation points
    2020-10-08T02:22:19.047+00:00

    @Federico Coppola
    First, we need to know that spam filtering can reduce spam as much as possible, it is impossible to completely block all spam.

    So, you can take other options to improve the security of your Office 365:

    1. Create a transport rule to add "[EXTERNAL]" to the message subject which sent from external of your organization, It will help users notice that this email is not from within your organization:
      30812-qa-kyle-1008101311.png
    2. Improve the level of mail filtering from Office 365 Security & Compliance. For more detailed information about it, you can have a look about this article: Anti-spam protection in EOP

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Edward van Biljon 6 Reputation points
    2020-10-09T12:58:03.363+00:00

    Hi

    Also check that you have your SPF and DMARC records in place.

  2. Federico Coppola 1,181 Reputation points
    2020-10-14T09:04:46.317+00:00

    Hi @Edward van Biljon @KyleXu-MSFT
    I will check them during next days.

    Thanks so much for your help!
    Federico

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.