THE SCAM You get an email that looks like an official Microsoft message. It says you need to keep your account credentials up to date, or sign an electronic document, and it gives you a link to do it. Here is the nasty part: the link really does point to Microsoft. Scammers set up an application inside Microsoft's own sign-in system and told it to send people on to their site after Microsoft handles the click. So you tap a genuine Microsoft link, and you still land on a page built to steal your personal information or slip malware onto your device. Security firm Kaspersky says it blocked more than 31,000 emails using this trick between August 1 and September 18, 2026.

THE RED FLAG The usual safety check does not work here. Most of us have learned to hover over a link and check where it goes — but this one really goes to Microsoft, so it passes the test and still hurts you. That is the whole point of the trick: borrowing a trusted name so your guard stays down. The other tell is the message itself. It showed up out of nowhere, asking you to update credentials or sign something, with a link as the only way forward. A real account problem does not arrive like that, dressed up as a chore you have to finish right now.

THE RULE Do not click the link in the email — even if it looks like it goes to Microsoft. If you are worried about your account, go there yourself: type the address into your browser, or open the app you already use, and check your account from there. A message that reaches out to you is never the place to type in a password or sign a document. If you already clicked and entered details, change your password from the real site right away and turn on two-factor authentication.

Read it online: https://erawaeb.com/digest/daily/042-the-microsoft-link-that-leads-to-a-scam-site/ (Source: Kaspersky report, October 2026)