What is SaaS abuse? How attackers misuse cloud services
SaaS abuse turns legitimate notifications, shared files, and app permissions into attack paths. Learn how it works, what to look for, and how to prevent it.
You receive an email saying someone has shared a document with you. It comes from a service your company uses, and the link opens that service's real website.
Then the document asks you to sign in somewhere else to view it, or perhaps the email claims you've been charged for a subscription and gives you a number to call. The service can be genuine while the request is fraudulent.
This is SaaS abuse. Attackers turning familiar cloud features into ways to steal credentials, distribute malware, or reach people with scams. Here's how it works and what you can do about it.
What is SaaS abuse?
SaaS abuse happens when someone misuses a cloud application's legitimate features for a malicious purpose. Attackers might create an account on a real service, share a harmful document, place deceptive text in an invitation, or abuse an app's access to data.
Think about OneDrive, SharePoint, Dropbox, Docusign, meeting platforms, and business applications. They need to send notifications, share files, and connect with other tools. Attackers can abuse those same features without hacking the SaaS provider itself.
Sometimes they use an account they registered, other times they compromise a real employee's or partner's account. Both can produce convincing messages, but the second may also exploit an existing relationship you already trust.
How does SaaS abuse work?
The pattern is simple, the attacker supplies the content, and a trusted service helps deliver it.
Imagine someone creates a file called Quarterly Report on a legitimate file-sharing platform. They share it with an employee, and the platform sends its normal notification. The employee opens the real sharing link, only to find a second link inside the document asking them to verify their account. That link leads to a phishing page.
The attack doesn't need a fake first link. It relies on the recipient carrying trust from the legitimate service over to the instruction inside the file. Other attacks skip links altogether and use authentic notifications to push recipients toward fraudulent support phone numbers.
Common types of SaaS abuse
Fake warnings inside legitimate notifications
Some services place user-controlled details, such as names or invitation text, inside automatic emails. An attacker can abuse those fields to insert a fake billing warning or a phone number they control.
In February 2026 research, Check Point described roughly 133,260 phishing emails reaching 20,049 organizations through abused SaaS workflows, including Microsoft and Amazon Business notifications. Those figures represent observed phishing activity, not confirmed compromises.
A phone-based lure might contain no malicious URL or attachment for an email scanner to inspect. The scam moves to the call, where the attacker can pressure the recipient to disclose information or authorize a payment.
Shared files that hide a second destination
A sharing notification may open a real document on SharePoint, OneDrive, or Dropbox. The phishing link appears inside that document, not necessarily in the email itself.
Microsoft documented this approach in October 2024. Attackers sometimes restricted files to specific recipients and made them view-only, complicating automated inspection. Some documents then led to adversary-in-the-middle phishing designed to capture authenticated sessions.
Legitimate restricted files can also require sign-in. The warning sign is an unexpected jump to an unrelated authentication page, not authentication by itself.
E-signature requests that lead to downloads
An attacker can use a real document-signing service to send an envelope with misleading content. For example, it may show a blurred preview and a button promising to reveal the text. Instead of displaying the document, the button leads to an external site asking the recipient to download software.
The signing request gives the document credibility, but the download instruction comes from its author. Verify any request to install a special viewer or an "unblurring" tool through the service's official website or your IT team before proceeding.
Connected applications with too much access
SaaS abuse isn't limited to email. Business tools connect through OAuth, which lets an application request access to data without collecting the user's password. Attackers can trick someone into approving an untrusted app or exploit an existing integration with excessive permissions.
MFA helps protect accounts, but it doesn't decide whether an application deserves access to mail or files. Review what the app requests and who controls it before approving. Our guide to OAuth abuse techniques explains how attackers misuse consent and other authorization flows.
Why can these attacks look safe?
A real SaaS notification may pass SPF, DKIM, and DMARC because the service actually sent it. These checks establish information about sending identity and authentication. They don't establish whether the person who submitted the document or invitation had honest intentions.
The first URL may also belong to a well-known platform, while the harmful destination sits one step later. Restricted documents can limit what automated scanners can inspect. And phone-based scams don't need a phishing URL at all.
A trusted delivery channel isn't proof that every instruction inside it can be trusted. That's the weakness attackers exploit.
How to recognize SaaS abuse
Look for a mismatch between the normal task and the action you're asked to take:
- Unexpected access: A file, workspace invitation, or signature request arrives without any related conversation.
- A second login site: A genuine shared file directs you to a different website to enter credentials or an MFA code.
- A new support number: A notification claims there's an urgent charge or account issue and tells you to call a number inside the message.
- An unnecessary download: Viewing a document suddenly requires software, a browser extension, or remote-support access.
- Excessive permissions: A connected app asks to read mail, access files, or retain access when its stated purpose doesn't require it.
One signal doesn't prove an attack. New colleagues share files, and some services require authentication. What matters is whether the request makes sense for the sender, service, and situation.
How to prevent SaaS abuse
For anyone receiving notifications, the best habit is to verify the requested action, not just the brand. Open your account from a bookmark or a known address to check charges or warnings. Confirm unexpected files with the supposed sender through a separate channel. Never install software or call a support number simply because a shared document or service email tells you to.
For IT and security teams, prevention needs a few different layers:
- Limit unnecessary sharing. Use links restricted to specific people for sensitive files, review external access, and remove shares that are no longer needed. Avoid blocking legitimate collaboration outright.
- Secure identities. Require MFA, prefer phishing-resistant methods, and monitor unusual sign-ins. Compromised accounts can misuse legitimate sharing features.
- Review app permissions. Control OAuth consent, challenge requests for broad access, and remove unused integrations.
- Watch behavior, not just sender reputation. Unusual invitations, mass file sharing, new external recipients, and unexpected app access may reveal abuse even when the notification is authentic.
- Make suspicious messages easy to report. Your response process should address harmful content or app access, not only remove the email that announced it.
