5 Phishing Attacks That Bypass Microsoft Safe Links (And What Actually Stops Them)

Safe Links Is Good. These Attacks Are Better.

Let us be clear about something before we start.

Microsoft Safe Links is not a bad product. It rewrites every URL in every email, runs a real-time reputation check the moment someone clicks, and stops millions of phishing attempts every single day. For most organisations running Microsoft 365, it is doing a lot of quiet, unglamorous work in the background.

The problem is not that Safe Links is broken.

The problem is that a very specific class of phishing attacks has been engineered specifically to look clean to Safe Links, right up until the moment they do their damage.

These are not theoretical edge cases. They are the techniques powering the campaigns that are successfully compromising Microsoft 365 environments right now, in 2026. Phishing volumes are now at an all-time high, and in most breach cases, phishing is the predominant starting point for hackers gaining access to business systems.

Here are the five you need to understand.

---

Attack 1: The Bait and Switch

The short version: The link is clean when Safe Links checks it. By the time your user clicks it, the page has changed.

How It Works

Imagine you buy a ticket to a concert. The venue address on the ticket says one location. But on the night of the show, you arrive to find the real concert is somewhere completely different and the new address is not what you signed up for.

That is essentially what this attack does to Safe Links.

An attacker sends a phishing email containing a URL that points to a completely clean, harmless page. Maybe it is a blank landing page. Maybe it is a legitimate article. Safe Links scans the URL during email delivery and again when the user clicks. Both times, it finds nothing wrong.

Then the attacker flips the destination.

Hours or days later, when the user finally opens the email and clicks the link, the URL now points to a credential harvesting page designed to steal their Microsoft 365 login. The user sees a convincing login prompt. Safe Links already made its decision and moved on.

Why Safe Links Cannot Catch It

Safe Links checks what a URL points to at a specific moment in time. It has no mechanism to detect that the destination changed after it already ran its check. Once a link has been cleared, it is cleared.

What Actually Stops It

A solution that checks a URL at the exact moment of click, every single time, regardless of prior checks. And more importantly, one that opens the destination inside an isolated session so even if the destination has switched to something malicious, it cannot reach the user's credentials or device.

---

Attack 2: The Scanner Detector

The short version: The phishing page shows a clean version of itself to Safe Links and saves the malicious content for real users.

How It Works

This one requires a little attacker sophistication, but it is increasingly automated and commercially available as part of phishing kits.

Safe Links sends requests from Microsoft's cloud infrastructure. That infrastructure has known IP ranges and uses recognisable scanning signatures. Skilled attackers detect these signals and serve completely different content to the scanner than they show to real users.

Think of it like a restaurant that has a beautiful menu for health inspectors and a completely different kitchen for actual customers.

When Safe Links visits the URL, it sees a clean, benign page. Green light. Email delivered. When your employee clicks the same link from their office IP address in Dublin or London, the page detects that they are a real human from a real corporate network and serves the actual malicious content.

Conditional redirects tied to user agent or region keep scanners on a clean path while real users see the final payload. This pattern shows up consistently in phishing attacks.

Why Safe Links Cannot Catch It

Safe Links cannot easily disguise itself as a real user. Its scanning infrastructure has characteristics that sophisticated phishing kits are built to detect. Even detonation environments can be fingerprinted by sufficiently advanced kits.

What Actually Stops It

Opening the destination inside a genuine isolated browsing session that mimics real user behaviour rather than a scanner. When the malicious content loads for what it believes is a real user, it loads inside the container where it cannot access the user's credentials or device. The attacker's evasion technique becomes irrelevant.

---

Attack 3: The Trusted Platform Trap

The short version: The link points to Microsoft SharePoint, Google Drive, or Dropbox. Safe Links cannot block those.

How It Works

This is the phishing technique that has caught the most sophisticated security teams off guard over the last two years. And it is devastatingly simple.

A particularly consequential campaign targeted law firms and professional services organisations through a combination of compromised SharePoint links, routing targets through a legitimate Microsoft domain to a credential harvesting page. The use of genuine Microsoft infrastructure in the delivery chain meant that email authentication checks passed cleanly.

The attacker either compromises a legitimate SharePoint or OneDrive account, or creates a free account and uses it to host a malicious document or redirect page. They send the victim a link to that SharePoint file.

Safe Links sees a link to microsoft.sharepoint.com. A trusted domain. A domain that Microsoft itself manages. There is absolutely no way Safe Links can flag a link to Microsoft's own platform as suspicious.

The user opens the document. Inside is a link to a credential harvesting page. Or the document itself contains a form designed to capture their login. Or the SharePoint page immediately redirects to a phishing site.

By then, the trusted platform has done its job as camouflage and it worked perfectly.

Why Safe Links Cannot Catch It

You cannot block SharePoint. You cannot block Google Drive or Dropbox either. These platforms are embedded in how modern businesses operate. Safe Links has no way to selectively evaluate the content sitting behind a trusted domain URL in real time.

What Actually Stops It

Isolation at the content level, not the domain level. When the SharePoint page loads inside an isolated container, whatever it contains, whether a redirect, a fake login form, or a malicious download, executes inside the container. It cannot reach the user's real credentials or device regardless of where it is hosted.

Attack 4: The QR Code Blind Spot

The short version: Safe Links scans text-based URLs. A QR code is an image. The malicious URL inside it is completely invisible to Safe Links.

How It Works

Picture this scenario. An email arrives in your finance team's inbox. It looks like a security notification from Microsoft. It has the right logo, the right colours, the right tone. Instead of a clickable link, it contains a QR code with instructions to scan it to verify your account.

Your email security stack scans the email. It checks the sender, the domain, the headers, and any text-based URLs. Everything looks fine. The email is delivered.

Your employee pulls out their phone and scans the QR code. Their phone opens a browser and loads a convincing Microsoft 365 login page. They enter their credentials. Those credentials are immediately captured by the attacker.

QR code phishing, or quishing, has surged 400% between 2023 and 2025. Attackers use QR codes to bypass email gateways because the malicious link is encoded in an image rather than text. According to the Anti-Phishing Working Group's Q2 2025 report, criminals targeted 1,642 brands using QR codes in phishing campaigns.

The entire attack happened on a personal mobile device. A device that almost certainly has no Safe Links protection at all.

Why Safe Links Cannot Catch It

Safe Links rewrites and checks text-based URLs. A QR code is a black and white image. The URL encoded inside it is invisible to any text-based URL scanner. Even if Safe Links could decode the QR code, the scan likely happens on a mobile device outside Microsoft's protection perimeter entirely.

What Actually Stops It

When the URL decoded from a QR code is opened through a browser or email client that uses isolation, the destination loads in the container rather than the user's local browser. The credential form cannot capture credentials from the local device because the local browser never connects to the destination.

For mobile-specific protection, the answer is ensuring any URL copied from a QR code is passed through a sandbox check before being opened on the device.

---

Attack 5: The Session Hijacker

The short version: This attack does not steal passwords. It steals the authenticated session after MFA has already been completed. Safe Links checks the URL. It cannot see what happens next.

How It Works

This is the one that makes security teams genuinely nervous, because it defeats both Safe Links and MFA simultaneously.

The technique is called Adversary-in-the-Middle, or AiTM, phishing. Here is how it plays out.

Your employee receives a phishing email with a link that looks like a genuine Microsoft login page. Safe Links checks the URL. The domain is new, clean, and has no reputation history. Green light.

The employee clicks through and lands on what genuinely looks like the Microsoft sign-in page. It is rendered in real time by a reverse proxy sitting between the user and Microsoft's actual servers. The employee types their password. The proxy captures it and passes it to Microsoft. Microsoft sends an MFA prompt. The employee approves it on their phone. MFA passes.

The proxy captures the authenticated session cookie that Microsoft issues after successful login. The employee is redirected to a genuine Microsoft page and has no idea anything happened. Meanwhile, the attacker now has a fully authenticated session cookie that lets them access the account as if they were the employee, with no further MFA required.

Modern phishing kits incorporate MFA bypass methods including session token theft, allowing attackers to intercept authenticated sessions in real time. Even organisations with multi-factor authentication in place are not immune when session hijacking is involved.

This is not a theoretical attack. The Tycoon2FA phishing platform, which uses exactly this technique, was responsible for 62% of all phishing attempts blocked by Microsoft in mid-2025 and still successfully compromised 55,000 Microsoft customers.

Why Safe Links Cannot Catch It

Safe Links scans the URL that begins the chain. That URL often points to clean infrastructure with no reputation history. Once Safe Links forwards the user through, the session interception happens in the space between the user's browser and Microsoft's servers. That is completely outside Safe Links' scope.

What Actually Stops It

Two things working together.

First, opening the link inside an isolated browsing session means the session cookie that gets captured belongs to the container, not the user's real browser. There is nothing valuable for the proxy to steal.

Second, phishing-resistant MFA using FIDO2 hardware keys eliminates the ability to proxy the authentication flow entirely. If the authentication cannot be replicated by a proxy, the session hijack fails regardless of how convincing the fake login page looks.

---

The Common Thread

Look at all five attacks and you will notice something.

Every single one of them operates in the space that comes after Safe Links has made its decision. They are specifically designed to look clean to a reputation-based scanner and then do their damage once the scanner has moved on.

That is not a coincidence. It is the design brief for modern phishing infrastructure.

Safe Links is a gate. These attacks are engineered to walk through the gate with the right credentials, then do whatever they want once they are on the other side.

What closes that gap is not a better gate. It is making sure that whatever gets through the gate cannot cause harm at the endpoint. That means isolation at click time, persistent throughout the session, regardless of what the destination contains.

---

What CyberCheck360 Does About Each One

Here is how CyberCheck360's click-time isolation layer addresses each of the five attacks directly.

Attack	How Safe Links Responds	How CyberCheck360 Responds
Bait and switch	Cleared at delivery. Re-check may still show clean.	Destination opens in isolated container. Changed content cannot reach endpoint.
Scanner detector	Served clean content. Passes check.	Real-user session detected but runs in container. Malicious content isolated.
Trusted platform trap	Cannot block trusted domains.	Content behind trusted URL isolated regardless of hosting platform.
QR code phishing	URL in image is invisible to scanner.	URL opened through isolation-enabled client runs in container.
Session hijacker	URL clears reputation check. Session capture is outside scope.	Session runs in container. Captured cookie is worthless. FIDO2 eliminates proxy auth.

---

Frequently Asked Questions

Can phishing attacks really bypass Microsoft Safe Links?

Yes. Microsoft Safe Links is effective against known threats catalogued in its threat intelligence database. But five specific attack categories are specifically engineered to bypass it: bait-and-switch attacks that change the destination after Safe Links checks it, scanner detection attacks that serve different content to scanning infrastructure, trusted platform attacks using SharePoint or Google Drive, QR code attacks that encode URLs in images Safe Links cannot read, and AiTM attacks that intercept sessions after authentication is complete.

What is a bait and switch phishing attack?

A bait-and-switch phishing attack sends a link that points to a clean, benign destination at the time email security tools scan it. After the scan is complete and the email is delivered, the attacker changes the destination to a malicious page. When the user clicks the link, they reach the malicious page even though the link cleared all security checks at delivery.

What is AiTM phishing and why does MFA not stop it?

Adversary-in-the-Middle phishing positions a reverse proxy between the user and a legitimate login page. The user authenticates normally, including completing MFA. But the proxy intercepts the authenticated session cookie after MFA succeeds, giving the attacker full access to the account without needing the password or MFA code again. Software-based MFA is vulnerable to this technique. FIDO2 phishing-resistant hardware keys prevent it because the authentication cannot be replicated by a proxy.

Why can Safe Links not block SharePoint phishing links?

Safe Links uses reputation-based URL checking. SharePoint is a trusted Microsoft platform with an established positive reputation. Blocking SharePoint URLs would break legitimate business operations for every Microsoft 365 customer. Safe Links cannot selectively evaluate the content sitting behind a trusted platform URL in real time, which is exactly why attackers use trusted platforms to host malicious content.

What is quishing and how does it bypass email security?

Quishing is phishing that delivers a malicious URL inside a QR code image rather than as clickable text. Email security tools including Safe Links scan text-based URLs. They do not decode and analyse URLs embedded in images. The malicious destination inside the QR code is invisible to the scanner. The user scans the code, typically on a mobile device outside corporate security controls, and reaches the malicious page undetected.

What is the best protection against phishing attacks that bypass Safe Links?

The most effective additional layer is click-time URL isolation, which opens link destinations in a containerised environment outside the user's device and network. This means that even if a link passes Safe Links' reputation check and leads to a malicious destination, the malicious content executes in the container rather than on the endpoint. Combined with FIDO2 phishing-resistant MFA for AiTM protection, this closes the gaps that Safe Links alone cannot cover.

Does CyberCheck360 replace Microsoft Defender?

No. CyberCheck360 works alongside Microsoft Defender for Office 365 as a post-delivery isolation layer. Defender handles known threat filtering, spam detection, and threat intelligence at scale. CyberCheck360 covers the click-time gap that follows a clean reputation check. The two layers address different stages of the attack chain and are designed to complement each other.

---

The Bottom Line

Safe Links does exactly what it was built to do. The five attacks in this blog do exactly what they were built to do, which is slip through the gap between what Safe Links checks and what happens after the user clicks through.

Closing that gap does not require replacing Safe Links. It requires adding a layer that operates where Safe Links stops: at click time, inside the session, between the user's browser and the destination.

That is what post-delivery link isolation does. And in 2026, for any organisation running Microsoft 365 that has experienced a phishing incident despite having Safe Links deployed, it is the most direct answer to the question of why it keeps happening.

Published by CyberCheck360 | Post-Delivery Email Security cybercheck360.com