Angvlar Security Awareness
Fake Microsoft 365 and Google Workspace sharing alerts
Distinguish legitimate shared-document notifications from copied cloud login pages.
Why this matters
Attackers frequently imitate familiar cloud sharing emails. The safest route is to open the service independently and check shared files from within the account.
By the end of this lesson
- Recognise the main warning signs
- Choose a safe verification method
- Know when and how to report the situation
What to notice
- Document from an unexpected person
- Generic file name such as Secure Document
- Link opens a different domain
- Login page asks for credentials after an unusual redirect
- Permission request is broader than needed
- Message says access expires immediately
What to do
- Open the cloud service directly
- Check the shared-with-me area
- Confirm the sender through a trusted channel
- Do not sign in through an unfamiliar domain
- Report suspicious sharing notifications
Frequently asked questions
Should a shared file require me to re-enter credentials?
Sometimes, but verify the domain and open the service independently.
What if the sender is known?
Their account may be compromised; confirm unexpected shares.
Can a file name prove legitimacy?
No.