Am I the only one that sees this as an issue? I have several customers that I manage, none of which are currently on Office 365. They have in house Exchange servers. But what we are seeing is the following and it is becoming a huge issue.
My customers work with any number of clients, vendors, or partners (senders) that ARE using Office 365 as their legitimate email servers. My clients have increasingly been receiving email from these senders that are actually SPAM, SCAM, PHISHING or otherwise non-legitimate email. But these are not just Email that are obvious spam that come from the senders spoofed address that can be blacklisted, but instead these are emails that look EXACTLY like the legitimate email from the senders and coming from the servers from which the senders would be sending.
So it is as if the hackers have broken into the legitimate mail account on the Office365 servers, extracted the verbiage, signatures, greetings, manner of speaking, logos, etc, etc, and have crafted the email with some sort of payload or misdirect and then send it to my clients from the VERY SAME bank or farm of Office365 servers.
These are impossible to block on our Spam service because blocking the SCAM would also block the legitimate email.
We notify the client that thy may have been hacked, and might need to change passwords. We forward these email to junk@office365.microsoft.com and phish@office365.microsoft.com in hopes that Microsoft Support will find a way to begin closing down these hackers on their end.
Of course, I have no direct way to call Microsoft Support and explain this to them, as we are not O365 subscribing business. I HAVE attempted to get the discussion going by opening a couple $500 support tickets as if it was a problem on our Exchange server, just so I could talk to someone at Microsoft. But they ultimately find that there is no issue with our servers, agree that the email is coming from MS servers, refund the money, but do NOT seem to want to take this back to Office365 Support to address it.
What else can I do?
