Fake File Shares and E-Signatures: The B2B Phishing Trap

In modern Canadian workplaces, clicking a SharePoint sharing notice, reviewing a OneDrive link, or executing a DocuSign contract has become second nature. Employees across Canadian enterprises process dozens of these notifications weekly without second thought. Cybercriminals understand this operational reflex intimately: they have largely abandoned crude spam templates to meticulously clone routine B2B collaboration workflows.

For CISOs, IT directors, and executive leadership, this operational shift represents an urgent operational challenge. The line separating legitimate business transactions from weaponized infrastructure has virtually disappeared. By mirroring collaborative SaaS platforms, threat actors no longer merely harvest enterprise passwords: they bypass standard multi-factor authentication (MFA) by hijacking active tenant sessions directly.

Why Fake File-Sharing Emails Trick Savvy Professionals#

Executive Summary: Weaponized document-sharing lures succeed because they blend into standard enterprise workflows and exploit operational urgency. By hosting lures on legitimate, compromised cloud infrastructure, attackers routinely bypass traditional Secure Email Gateways (SEGs) and neutralize employee vigilance.

The operational success of this vector relies on contextual social engineering. Threat actors do not invent foreign narratives: they embed themselves seamlessly into the everyday software ecosystem of Canadian enterprises.

• Pixel-perfect visual mimicry: Fonts, brand layouts, corporate logos, and official legal footers from leading cloud vendors are cloned flawlessly. A busy manager or finance executive encounters familiar visual cues and immediately drops their natural defence posture.
• Evading Secure Email Gateways: Attackers regularly exploit trusted, free-tier cloud storage or compromised tenant accounts to host benign pivot documents (such as clean PDFs or OneNote files) containing the actual payload link. Email inspection filters assess a reputable domain name, score the message as safe, and deliver it directly to the inbox.
• Administrative urgency: Overdue vendor invoices, executive employment amendments, or mandatory non-disclosure agreements ahead of strategic acquisitions: these pretexts compel employees to click rapidly to prevent operational bottlenecks.

AiTM Attacks and Session Hijacking: How MFA Is Bypassed#

Executive Summary: Adversary-in-the-Middle (AiTM) frameworks intercept corporate credentials and active session tokens in real time by proxying traffic between the target and the legitimate cloud provider. Even when secondary authentication is approved, the attacker captures the session cookie, gaining direct access to enterprise data.

For years, rolling out multi-factor authentication (MFA) was treated across Canadian boards as the definitive baseline control against credential harvesting. Against modern AiTM toolkits, however, conventional MFA methods fail unless they are cryptographically phishing-resistant.

The Malicious Reverse-Proxy Blueprint

When a team member clicks a fraudulent document-signature link, they rarely hit a crude static web form. Instead, they are routed through an automated reverse proxy orchestrated by the adversary:

1. The spoofed landing page queries the genuine cloud authentication endpoint (such as Microsoft 365) in real time.

2. The user submits their corporate username and password into the mirror portal.

3. The genuine identity platform prompts the victim with an MFA challenge (such as an authenticator push or SMS passcode), which the employee approves in good faith.

4. The cloud service validates the login and generates an authenticated session token (session cookie).

5. The adversary's proxy intercepts this token mid-flight before redirecting the employee to an innocuous corporate landing page to avoid suspicion.

Armed with this stolen session token, the threat actor injects the cookie into their own browser, establishing persistent corporate tenant access without needing to re-enter credentials or trigger secondary MFA challenges.

Concrete Defences to Neutralize Collaboration Lures#

Technology controls alone cannot completely eliminate risks that exploit human workflow habits. However, reinforcing specific operational behaviours significantly curtails enterprise exposure:

• Scrutinize the final browser URL: While the email notification may look authentic, the destination domain in the address bar reveals the truth. An unfamiliar top-level domain or irregular subdomain immediately signals a malicious reverse proxy.
• Enforce out-of-band verification: When an existing vendor or executive issues an unannounced document requiring urgent signature, validating the request via phone or established internal messaging stops fraudulent transactions before execution.
• Deploy phishing-resistant hardware keys: Enforcing hardware security keys aligned with FIDO2 standards neutralizes AiTM proxies. The hardware key cryptographically ties user authentication exclusively to the genuine domain, refusing to sign authentication challenges on spoofed hostnames.
• Implement frictionless incident reporting: Providing staff with a single-click mechanism to flag suspicious emails without fear of punitive measures empowers the Security Operations Centre (SOC) to invalidate compromised session tokens before broader tenant enumeration occurs.

BRAIN SECURITY PRODUCT IN ACTION · Super Phisher

Training Your Teams Against Real-World Collaboration Scenarios#

Theoretical security compliance policies do not protect an employee reviewing urgent contracts during a chaotic workday. Building sustained operational vigilance requires realistic, contextual exposure to the tactics threat actors actually use.

This is the exact mandate of Super Phisher, our specialized phishing simulation solution. Deployed hand-in-hand with the Brain Security team, this capability evaluates your workforce against sophisticated modern scenarios: spoofed OneDrive shares, fraudulent executive sign-off notifications, and simulated cloud sync warnings. The goal is never to trick employees for punitive tracking, but to transform automatic clicking habits into practical, positive learning experiences.

Against threat actors exploiting the everyday routines of Canadian business operations, arming your personnel with technical and visual awareness is essential to your cyber defence strategy. Speak with our team to establish an engaging training programme tailored to your technology stack and corporate risk profile.

Further reading: related articles and Brain Security solutions#

Related articles on this topic

• AiTM Phishing: Why Session Cookies Are Stolen Despite 2FA (Phishing & Social Engineering) : Learn how AiTM reverse proxy attacks bypass MFA through session cookie theft, and discover technical and human defences to protect Canadian enterprises.
• Social Engineering on Professional Networks: When a Fake Job Offer Masks an Intrusion (Phishing & Social Engineering) : Discover how threat actors exploit professional networks to deceive Canadian personnel with fake job opportunities and bypass corporate defences.
• Passwords, Password Managers, and Passkeys: Modernizing Identity Hygiene Without Friction (Phishing & Social Engineering) : Move past 90-day password resets. Discover CCCS and NIST guidance to deploy passphrases, vaults, and passkeys while reducing user fatigue.
• HR Cybersecurity: Defending Against Weaponized Resumes and AI Deepfake Candidates (Industries & Roles) : Protect your Canadian HR teams from weaponized CVs, malicious portfolios, and live AI deepfake candidates during remote hiring cycles.

Explore Brain Security solutions on our website

• Featured solution : Super Phisher : The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.
• Browse use cases by security goal and Canadian industry
• Compare our cybersecurity and AI awareness formats
• Explore the full interactive Brain Security catalogue
• Discuss your needs with our team (demo and setup)