---
title: "Microsoft Office 365: A Phishing Attack Waiting to Happen | DuoCircle"
description: "There are a lot of benefits to using Microsoft Office 365. It contains business tools with which you’re already familiar."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/phishing-protection/microsoft-office-365-a-phishing-attack-waiting-to-happen/"
---

Quick Answer

Office 365's native phishing protection misses enough attacks to leave most tenants exposed. A two-year Mimecast Email Security Risk Assessment found Office 365 let through more than 33,000 impersonation attacks plus malicious attachments. Recorded Future's analysis of 2018 exploit data put eight of the top ten most-exploited vulnerabilities as Office bugs, driven by phishing campaigns using rigged Word and Excel attachments. The NoRelationship attack bypasses Office 365's URL filters by embedding a malicious link inside a .docx attachment that points to a credential-harvesting page. Treat Office 365 as having no phishing protection by default and add a layer that re-scans every URL on click against multiple reputation databases. Cloud-based phishing protection deploys in about 10 minutes on top of the Microsoft 365 tenant.

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Fmicrosoft-office-365-a-phishing-attack-waiting-to-happen%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Microsoft%20Office%20365%3A%20A%20Phishing%20Attack%20Waiting%20to%20Happen&url=undefined%2Fblog%2Fphishing-protection%2Fmicrosoft-office-365-a-phishing-attack-waiting-to-happen%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Fmicrosoft-office-365-a-phishing-attack-waiting-to-happen%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Fmicrosoft-office-365-a-phishing-attack-waiting-to-happen%2F&title=Microsoft%20Office%20365%3A%20A%20Phishing%20Attack%20Waiting%20to%20Happen "Share on Reddit") [ ](mailto:?subject=Microsoft%20Office%20365%3A%20A%20Phishing%20Attack%20Waiting%20to%20Happen&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Fmicrosoft-office-365-a-phishing-attack-waiting-to-happen%2F "Share via Email") 

![phishing attack](https://media.mailhop.org/duocircle/images/2019/04/spf-permerror-6677.jpg) 

There are a lot of benefits to using Microsoft Office 365\. It contains business tools with which you’re already familiar. It’s easy to set up and offers anytime, anywhere access.

You’ll see many of these features and benefits promoted on the Office 365 website. Won’t you want to see there among the list though is that _using Office 365 makes you extremely vulnerable to a phishing attack_. Why is that?

There are two factors that conspire to make Office 365 users vulnerable to a **phishing attack**. The first is Office 365 itself. It’s really popular, and that makes it a big, juicy target for hackers. The other factor is that the [phishing protection](/email/phishing-protection) native to Office 365 just isn’t good enough.

The recent Mimecast Email Security Risk Assessment (ESRA) aggregate [report](https://web.archive.org/web/20191206005809/https://www.mimecast.com/resources/white-papers/dates/2019/2/mimecast-email-security-risk-assessment-quarterly-report/) collected email data over two years specifically with Microsoft Office 365\. What they found is that Office 365 “misses a variety of ‘bad’ emails.” Specifically, Office 365 let in more than 33,000 impersonation attacks, as well as unwanted, potentially dangerous or malicious file attachments.

These findings were confirmed in a new [study](https://www.darkreading.com/vulnerabilities---threats/microsoft-office-dominates-most-exploited-list/d/d-id/1334198?%5Fmc=NL%5FDR%5FEDT%5FDR%5Fweekly%5F20190321&cid=NL%5FDR%5FEDT%5FDR%5Fweekly%5F20190321&elq%5Fmid=90050&elq%5Fcid=28171904) by Recorded Future. According to the study, “_Eight of the top 10 most exploited vulnerabilities in 2018 were Office bugs_.”

“It should come as no surprise that cybercriminals favored Microsoft Office vulnerabilities in their cyber attacks last year, given the rise in phishing attacks that included rigged Word and Excel Office file attachments.”

[![email security](https://media.mailhop.org/duocircle/images/2019/04/spf-flattening-5552.jpg)](https://media.mailhop.org/duocircle/images/2019/04/spf-flattening-5552.jpg)

Email Protection Security from Spam virus. Internet network, Secure data email, Security protection notification on internet letter security protect, junk and trash mail and compromised information

Now, according to an [article on Credit Union Times](https://www.cutimes.com/2019/03/04/norelationship-ms-office-phishing-attack-bypasses-url-filters/?slreturn=20190302075431), there’s a new Office 365 exploit. Called a NoRelationship attack, it bypasses Office 365 email attachment security which scans Office documents like Word (.docx), Excel (.xlsx), and PowerPoint (.pptx). “The attack emails include a .docx attachment containing a malicious link that leads to a credential harvesting login page.”

If you’re using Office 365 and you think you’re security worries are over, they’re just beginning. When using Office 365, it’s best to assume that you have no phishing protection and act accordingly. Fortunately, it’s easy and inexpensive to add [cloud-based email security](/) to Office 365\. It comes with real-time **link click protection**, so even if a malicious email gets into your Office 365 inbox, you’re still protected.

Don’t be lulled into a false sense of security. Add **email security to Office 365** and make all what those hackers do a waste of time.

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

Brad Slavin 

General Manager

General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.

## Secure your email infrastructure

Protect, authenticate, and deliver. Contact our team to find the right solution.

[Contact Sales](/contact/) [Explore Products](/products/) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fmicrosoft-office-365-a-phishing-attack-waiting-to-happen%2F) [ ](https://twitter.com/intent/tweet?text=Microsoft%20Office%20365%3A%20A%20Phishing%20Attack%20Waiting%20to%20Happen&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fmicrosoft-office-365-a-phishing-attack-waiting-to-happen%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Fmicrosoft-office-365-a-phishing-attack-waiting-to-happen%2F) Copy 

Related Articles

- [ ![AI-Generated Phishing](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4522.jpg)  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Phishing ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)
- [ ![spf-permerror-4555](https://media.mailhop.org/duocircle/images/2023/05/spf-permerror-4555.jpg)  10 Applications of ChatGPT that Hackers Are Already Exploiting Phishing ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)
- [ ![Email-Based Cyber-Attacks](https://media.mailhop.org/duocircle/images/2016/03/spf-record-tester-4455.jpg)  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Phishing ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)
- [ ![Email-based Ransomware Attacks](https://media.mailhop.org/duocircle/images/2018/02/email-smtp-service-7834.jpg)  7 Ways to Protect Your Organization from Email-based Ransomware Attacks Phishing ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

## Related Articles

[  Phishing 11m  AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough  Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[  Phishing 5m  10 Applications of ChatGPT that Hackers Are Already Exploiting  May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[  Phishing 4m  65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks  Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[  Phishing 9m  7 Ways to Protect Your Organization from Email-based Ransomware Attacks  Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/)

```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Microsoft Office 365: A Phishing Attack Waiting to Happen","description":"There are a lot of benefits to using Microsoft Office 365. It contains business tools with which you’re already familiar.","url":"https://www.duocircle.com/blog/phishing-protection/microsoft-office-365-a-phishing-attack-waiting-to-happen/","datePublished":"2019-04-03T15:39:29.000Z","dateModified":"2025-06-16T14:40:52.000Z","dateCreated":"2019-04-03T15:39:29.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/microsoft-office-365-a-phishing-attack-waiting-to-happen/"},"articleSection":"phishing-protection","keywords":"","wordCount":413,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/04/spf-permerror-6677.jpg","caption":"phishing attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"Microsoft Office 365: A Phishing Attack Waiting to Happen","item":"https://www.duocircle.com/blog/phishing-protection/microsoft-office-365-a-phishing-attack-waiting-to-happen/"}]}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Microsoft Office 365: A Phishing Attack Waiting to Happen","item":"https://www.duocircle.com/blog/phishing-protection/microsoft-office-365-a-phishing-attack-waiting-to-happen/"}]}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"Microsoft Office 365: A Phishing Attack Waiting to Happen","description":"There are a lot of benefits to using Microsoft Office 365. It contains business tools with which you’re already familiar.","url":"https://www.duocircle.com/blog/phishing-protection/microsoft-office-365-a-phishing-attack-waiting-to-happen/","datePublished":"2019-04-03T15:39:29.000Z","dateModified":"2025-06-16T14:40:52.000Z","dateCreated":"2019-04-03T15:39:29.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/microsoft-office-365-a-phishing-attack-waiting-to-happen/"},"articleSection":"phishing-protection","keywords":"","wordCount":413,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/04/spf-permerror-6677.jpg","caption":"phishing attack","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```