Fake Document Shares and E-Signatures: The B2B Phishing Trap

In the modern digital workplace, clicking on a SharePoint sharing notification, accessing a OneDrive link, or reviewing a DocuSign agreement has become second nature. Employees process dozens of these collaboration prompts every single week without hesitation. Cybercriminals understand this behaviour perfectly: they have largely abandoned rudimentary, generic spam in favour of meticulously replicating day-to-day enterprise workflows.

For CISOs, security directors, and SOC teams, this shift presents a formidable operational risk. The boundary between a routine business interaction and a weaponised payload has blurred. By mimicking enterprise cloud platforms down to the pixel, threat actors no longer merely harvest static credentials: they systematically bypass Multi-Factor Authentication (MFA) by hijacking live session tokens directly from your personnel.

Why Fake File-Sharing Emails Deceive Seasoned Professionals#

In summary: Fake document-sharing lures succeed because they mirror trusted workplace routines and exploit professional urgency. By hosting lures on legitimate or compromised cloud architectures, attackers bypass standard Secure Email Gateways (SEGs) and disarm employee vigilance.

The operational success of this vector relies on context-aware social engineering. Rather than inventing novel pretexts, attackers insert themselves directly into genuine corporate workflows:

• Flawless visual mimicry: Interface templates, brand typography, system icons, and legal disclaimers from major cloud providers are copied with exacting precision. A busy employee, scanning notifications between meetings, recognises familiar visual signposts and immediately drops their guard.
• Evading email security gateways: Adversaries routinely exploit legitimate, free-tier cloud services or compromised third-party accounts to host benign-looking staging documents, such as an authentic OneNote page or hosted PDF containing the weaponised link. Because the initial email points to an established, highly trusted domain, standard Secure Email Gateways (SEGs) let the message pass straight through.
• Operational and administrative urgency: Outstanding supplier invoices, contractual amendments, or pre-meeting Non-Disclosure Agreements (NDAs) are selected specifically to compel immediate action, exploiting the recipient's desire to avoid operational bottlenecks.

AiTM Attacks and Session Hijacking: How MFA Is Bypassed#

In summary: Adversary-in-the-Middle (AiTM) frameworks intercept credentials and session cookies in real time by acting as a transparent reverse proxy between the user and the cloud provider. Even when MFA is completed, the attacker captures the authenticated session token.

For years, rolling out Multi-Factor Authentication (MFA) was regarded as the definitive answer to credential theft. However, standard push-notification or SMS-based MFA methods offer minimal resistance against modern Adversary-in-the-Middle (AiTM) reverse proxy frameworks.

The mechanics of the malicious reverse proxy

When an employee clicks on a fraudulent e-signature or document link, they are rarely directed to a static phishing form. Instead, they are routed to an adversarial reverse proxy (such as Evilginx):

1. The fraudulent proxy immediately mirrors the live login portal of the target cloud provider (such as Microsoft 365 or Google Workspace).

2. The user enters their corporate email address and password into this proxy interface, which relays the inputs to the genuine authentication service in real time.

3. The legitimate identity provider issues an MFA challenge (such as an authenticator push prompt or one-time passcode) to the user's registered device, which the employee validates unsuspectingly.

4. The genuine server verifies the authentication and issues an authenticated session token (session cookie).

5. The attacker's proxy intercepts and logs this session token before redirecting the victim to a benign corporate document to conceal the compromise.

Armed with this stolen session cookie, the adversary injects it directly into their own browser session, achieving full corporate cloud access without ever needing to crack passwords or trigger further MFA alerts.

Practical Measures to Defend Against Collaboration Lures#

Technical controls alone cannot fully protect an organisation when attacks deliberately exploit human routine. Combining robust technical controls with pragmatic operational reflexes builds meaningful defence:

• Scrutinise the destination URL in the browser bar: While the inbound email may appear flawless, the fully qualified domain name (FQDN) in the browser address bar reveals the proxy. A typo-squatted domain or unrecognised subdomain immediately exposes the infrastructure.
• Implement out-of-band verification: When an existing supplier or internal executive sends an unexpected document requesting an urgent signature, verifying the request via a phone call or direct internal instant message prevents intrusion.
• Deploy phishing-resistant hardware security keys: Enforcing FIDO2 and WebAuthn hardware tokens or passkeys provides cryptographic defence against AiTM proxies, as the authentication handshake is bound explicitly to the genuine domain URI.
• Streamline the reporting process: Allowing employees to flag suspicious documents via a single-click reporting plugin without fear of criticism ensures your SOC receives early telemetry before a tenant-wide compromise unfolds.

BRAIN SECURITY PRODUCT IN ACTION · Super Phisher

How to Train Your Teams Against Realistic Collaborative Phishing#

Theoretical slide decks and annual compliance modules do little to protect staff when an authentic-looking OneDrive alert arrives in the middle of a demanding day. Cultivating resilient reflexes requires controlled, true-to-life exposure to the very tactics attackers deploy.

This is the exact mission of Super Phisher, our advanced phishing simulation platform. Deployed in close collaboration with the Brain Security team, Super Phisher allows you to benchmark your staff against the latest B2B attack patterns: weaponised OneDrive sharing notifications, urgent contract signing requests, and simulated cloud synchronisation prompts. The goal is never punitive: it is about converting automatic behavioural vulnerability into an immediate, constructive learning milestone.

As cybercriminals continue to weaponise everyday enterprise software, equipping your workforce with sharp visual discernment and reporting reflexes is essential. Book a demo with our team to construct a tailored human risk programme aligned with your operational architecture and threat exposure.

Further reading: related articles and Brain Security solutions#

Related articles on this topic

• AiTM Phishing: Why Even 2FA Codes Entered on Fake Pages Are Stolen (Phishing & Social Engineering) : Discover how AiTM phishing bypasses multi-factor authentication via session cookie theft, and explore practical solutions to protect your organisation.
• Social Engineering on Professional Networks: Fake Job Offers Hiding Intrusions (Phishing & Social Engineering) : Discover how adversaries exploit professional social networks with fake job offers to bypass perimeter security and compromise enterprise access.
• Passwords, Password Managers and Passkeys: Evolving Security Practices Without Friction (Phishing & Social Engineering) : Why ditch 90-day password resets? Learn how NCSC, NIST and ANSSI guidance helps roll out passphrases and passkeys without employee friction.
• HR Cybersecurity: Spotting Weaponised CVs and AI Deepfake Candidates (Sectors & Roles) : Learn how to protect UK recruitment teams from malicious CVs, weaponised portfolios, and AI deepfake candidates during remote video interviews.

Explore Brain Security solutions on our website

• Featured solution : Super Phisher : The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.
• Browse use cases by security goal and sector
• Compare our cybersecurity and AI awareness formats
• Explore the full interactive Brain Security catalogue
• Discuss your needs with our team (demo and setup)