High Severity

Attachment: Microsoft SharePoint Impersonation via images in macro-enabled attachment

Labels

Credential Phishing

Impersonation: Brand

Optical Character Recognition

Description

Detects macro-enabled Office documents (docx and similar extensions) that contain images with text mimicking Microsoft SharePoint file-sharing notifications. The embedded images reference SharePoint collaboration language such as invitations to edit or references to Microsoft 365 access controls, designed to deceive recipients into trusting the attachment.

References

No references.

Sublime Security

Created Jul 16th, 2026 • Last updated Jul 16th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
// office docx
and any(filter(attachments, .file_extension in $file_extensions_macros),
        any(file.explode(.),
            // that contain sharepoint file share email wording in images
            strings.icontains(.scan.ocr.raw,
                              ' invited you to edit',
                              'This invite will only work for you and people with existing access',
                              ' use of Microsoft 365 and may contain content that is controlled by'
            )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started