A fake voicemail campaign got past Microsoft's spam scoring three times out of four

Email security vendor INKY, part of Kaseya, published a technical write-up on 27 August of a phishing operation that ran from 1 June to 4 August 2026. Infosecurity Magazine covered it the following day. The volumes are large without being surprising: 26,589 messages across 5,527 organisations, sent in waves that largely stopped at weekends, with the biggest single day on 3 June when 2,432 messages reached 1,149 organisations. INKY said the campaign was still running when its analysis closed.

What makes it worth five minutes is not the volume. It is that most of those messages arrived in Microsoft 365 mailboxes rated as ordinary email.

The lure was the most boring thing in your inbox

Each message posed as an internal voicemail notification. In 99.5% of cases the subject line contained the local part of the recipient's own email address, the bit before the @ sign, which is the cheapest personalisation available and reads exactly like a system-generated notice. The attachment carried a voicemail-style filename. Nobody had to be careless to open one, because a voicemail notification with your own name in the subject line is the least interesting thing that happens in a working day.

An image file that does not get treated as an image

The attachments were SVG files. SVG is a vector image format written in XML, and unlike a JPEG it can contain JavaScript. INKY found a minimal graphic shell wrapped around obfuscated script that rebuilt strings at runtime using junk identifiers and String.fromCharCode, then reached out to a remote endpoint. Deferred execution and runtime script injection made the behaviour harder to identify by static inspection.

The evasion was simpler than the code. Those attachments declared a MIME type of text/plain rather than image/svg+xml, so a scanner keying on the declared type saw an innocuous text file rather than something capable of executing.

Why the native filter waved them through

INKY reported that 95% of the messages claimed to come from the recipient's own domain while arriving from an external sender that had never authenticated to that organisation's mail server. That is textbook internal spoofing, and it is meant to be catchable.

The scoring tells the story. Microsoft assigns a Spam Confidence Level to inbound mail. Some 19,994 messages, 75% of the total, were given an SCL of 0 or 1, which Microsoft treats as not spam. Only 4,777, around 18%, were assigned SCL 5. The whole campaign was built from a single template, and yet the same message drew different native verdicts depending on which mailbox received it.

Same email, different answer

That last detail is the one to sit with. If one template produces a clean verdict in one tenant and a spam verdict in another, a colleague telling you their copy got flagged tells you nothing about whether yours will be. Native filtering does bulk triage well. It was never designed to be the only control standing between a member of staff and a file that runs code.

What to change in a Microsoft 365 tenant

Four things, in rough order of payback. Treat SVG as active content rather than as an image, and consider blocking or quarantining inbound SVG attachments outright, because very little legitimate business email needs one. Tighten internal-spoof detection so a message claiming to come from your own domain while arriving from outside gets challenged rather than trusted, which in practice means SPF, DKIM and DMARC set up properly rather than half configured. Favour detection that looks at behaviour over lists of known-bad file hashes, since a campaign built from one template can produce a fresh hash for every message. And tell your staff the thing most of them have never been told: an image file can carry code, and a voicemail notification is a very normal-looking way to deliver one.

None of that is exotic and none of it needs a new product. It does need somebody to own it. In a lot of smaller firms the real answer to who checks the tenant's anti-spoofing settings is nobody, because it worked on the day it was set up and has not been looked at since.