Someone used my website to send people to Microsoft's real sign-in page. Checking the URL wouldn't have saved them. These 12 checks would.
Get the checklist ↓One line each. Tick as you go, or copy it as text for your team.
THE REAL-LOGIN PHISHING CHECKLIST (meta.sui) A · Before you tap Accept ☐ A shared file should never need you to approve a new app. ☐ Read who's asking: app name + publisher. Unverified + wants mail/files = Cancel. ☐ Read what it wants. Does it match what you were trying to do? ☐ After signing in, look where you landed. Asked for your password again, or not on a Microsoft/Google address = close it. ☐ Not sure? Cancel and ask. (Microsoft's consent screen has a "Report it here" link.) B · If you already tapped Accept ☐ Microsoft work/school: myapplications.microsoft.com → app → … → Manage your application → Revoke Permissions. ☐ Google: myaccount.google.com/linkedapps → Access to your Google Account → app → See details → Remove access. ☐ Tell IT anyway. They can check the app's activity and sign-in logs. C · For IT and admins ☐ Entra: User consent settings → allow only verified publishers, selected permissions. ☐ Entra: Admin consent settings → let users request admin consent; pick reviewers. ☐ Review apps people already approved. New settings don't undo old grants. ☐ Google Workspace: Security → Access and data control → API controls → Settings → restrict unconfigured third-party apps.
A checklist only works if you believe it. So try it on three screens first:
All three are redrawn illustrations, not real apps. Pick one, then see why.
You clicked Open file in an email: “A file was shared with you.”
You chose Sign in with Microsoft on a scheduling tool your team already uses.
You signed in on the real Microsoft page. The next page says your session expired.
Anyone can register an app with Microsoft. Sign in “to” it, and the page you see is Microsoft's own. Then it goes one of two ways:
Microsoft forwards you to an address the scammer chose. That page asks for your password, or pushes a download. 2
The consent screen is real. Tap Accept and their app gets your data. No password needed. This is consent phishing. 1
The same redirect trick works with Google Workspace sign-in links too. Microsoft's own write-up shows both.
visitors to my website in one week. Only 219 came from Google. That gap is what made me look.
of the rest weren't people. They were email scanners in data centres, opening the same few pages and clicking every link.
pages someone had put on my platform, all on the same template: “A file was shared with you,” one button, and the button went to Microsoft's real sign-in.
I took all 27 pages down and suspended the accounts behind them. I didn't follow the links to see which path each one used, and I'm not going to guess. That's why the checklist covers both.
Not necessarily. Path 2 doesn't need your password at all. If you tapped Accept on something you don't recognise, do group B now.
No. Microsoft's own security blog shows the same redirect trick using Google Workspace sign-in links, and Google accounts have the same kind of “allow this app” screen.
Partly. Microsoft Learn says that once it disables a malicious app, new tokens are refused, but access tokens it already has stay valid until they expire. Remove the app and tell IT anyway.
Please do. Use “Copy as text” at the top of the checklist, or send them this link.
Menu names checked on Oct 6, 2026. Microsoft and Google rename things, so if a menu has moved, the linked page is the one to trust.
If you look after a team's accounts, or you're the person everyone asks “is this link safe?”, this page is yours to pass around.
I build things with AI, and this happened on something I built. Writing it down was the most useful thing I could do with it.
I share what I learn like this on @asksui.ai.
— Sui