An email saying that your Microsoft app passwords need to be updated can sound both technical and urgent. It may claim that you recently changed your password, mention two-step verification, and warn that older mail apps or devices will soon stop working.
The language is believable because app passwords are a real security feature. That small piece of truth is what makes this phishing email dangerous. Before following its instructions, learn how to verify the alert safely and what the sender is actually trying to obtain.
Overview
The “App Passwords Need to Be Updated” email scam is a credential-phishing campaign that impersonates a Microsoft account security notice. Its goal is to persuade recipients to open a fake sign-in page and enter the password for their Microsoft account.
The message says that the recipient recently changed their password. Because two-step verification is supposedly enabled, it claims that new app passwords must be created for applications or devices that do not support the newer sign-in method.
A prominent button labeled “Get a new app password” appears to provide the solution. Instead of opening a Microsoft account page, the button leads to a phishing site controlled by criminals.
In the observed campaign, the fake page was placed on Google Cloud Storage. Google is not involved in the scam. Attackers are simply abusing a legitimate cloud-hosting service because a familiar domain and HTTPS connection can make a malicious page seem safer than it is.
Why the claim sounds legitimate
App passwords are real. They are special passwords generated for older applications and devices that cannot complete modern two-factor authentication. They let the app connect without exposing the user’s regular account password to that older software.
Microsoft provides app-password controls through the Advanced security options of the official Microsoft account dashboard. Google and Apple also document app-specific password systems for certain third-party apps.
There is another truthful detail inside the scam. Changing a primary account password can invalidate existing app passwords on some platforms. Google and Apple explicitly state that app passwords are revoked after the main password is changed or reset.
That makes the story plausible to someone who has recently updated a password or uses Outlook, Thunderbird, Apple Mail, a scanner, or another older client. The scammer does not need every statement to be false. A phishing message often works best when it wraps one malicious instruction in several accurate technical facts.
What a real app-password update looks like
A legitimate app password is created while you are already signed in to the provider’s official security dashboard. You choose the app or device that needs access, generate a unique password, and enter that password into the specific app.
You do not normally confirm the change by submitting your main Microsoft password to a page reached through an unexpected email. If you need to manage a Microsoft app password, open a new browser tab and go to your Microsoft account yourself.
Microsoft’s official instructions direct users to the App passwords section under Advanced security options. That independent path is the important difference. It removes the email and its destination from the decision.
If there is no app-password warning after you sign in through the official account dashboard, the email cannot create one. Delete the message and continue using your account normally.
The email and the fake page
The phishing email is designed to resemble a clean Microsoft account notification. Its subject refers to Microsoft account 2FA, while a large headline says that app passwords need to be updated.
The body claims that the main password changed recently and warns that existing app passwords will stop working. A blue button invites the recipient to generate a replacement.
After the click, the victim sees a fake session-expired message. The email address may already be filled in, leaving only a password field and making the page feel like the final step of an existing Microsoft session.
A prefilled email address proves nothing. Phishing links can carry the recipient’s address as a parameter, and scammers already know the address because that is where they delivered the message.
Any password typed into the fake form is sent to the attackers. The page may then display an error, redirect to a genuine Microsoft website, or ask for additional verification. These behaviors are meant to hide the theft and delay the victim’s response.
Warning signs that expose the scam
The email may look polished, but several details reveal that it should not be trusted:
- You did not make the claimed change. If you did not recently change your Microsoft account password, the premise is immediately suspicious.
- The sender’s domain is unrelated to Microsoft. A display name can say “Microsoft account team” while the real address belongs to an unknown domain.
- The button does not lead to Microsoft. The destination may use cloud storage, a compromised website, a URL shortener, or a lookalike domain.
- The message asks you to solve the issue through its own link. A legitimate security setting should also be visible when you independently open the official account dashboard.
- The fake page says your session expired. This common phishing prompt gives the attacker a convenient reason to request the password again.
- Your address is already filled in. Personalization can come directly from the phishing link and is not proof that Microsoft created the page.
- The page requests the main password. An app password is a separate generated credential. The phishing form is trying to collect the valuable primary password instead.
A padlock does not mean the page belongs to Microsoft
Many people look for HTTPS and a padlock before signing in. Encryption is important, but it only protects the connection between your browser and the site you opened.
It does not verify that the site belongs to the company shown on the page. A phishing site can have a valid certificate, and a cloud-storage provider can securely deliver a malicious file uploaded by an unrelated customer.
Read the full hostname from right to left before entering a password. The registered domain must actually belong to Microsoft, not merely contain words such as “Microsoft,” “account,” “security,” “login,” or “office” somewhere in a longer address.
On a phone, the address bar may hide most of the URL. Tap it to reveal the complete address, or close the page and open the official account site manually. When security is at stake, direct navigation is faster than trying to decode a complicated link.
How The Scam Works
1. Criminals send a believable security notification
The attack starts with a bulk email that appears to come from the Microsoft account team. Some campaigns target random addresses, while others use addresses collected from data breaches, company websites, public directories, or previous phishing operations.
The sender name is easy to forge. Email applications often display the friendly name more prominently than the actual address, so a recipient may see “Microsoft account team” and never notice the unrelated domain beside it.
The message does not need to know whether you use app passwords. It relies on uncertainty. Many recipients use Microsoft services at work or at home and may assume the alert concerns an old device they have forgotten.
2. A real security feature provides cover
The attacker refers to two-step verification and app passwords because both terms belong to legitimate account security. This borrowed accuracy helps the email survive a quick common-sense check.
Technical language also discourages questions. A person who does not understand app passwords may click because the email sounds authoritative, while an experienced user may recognize that password changes can affect older apps and click for that reason.
The correct response is the same for both users: verify inside the account. A real setting leaves evidence in the official security dashboard. A phishing claim exists only inside the email and the page it controls.
3. The message creates urgency without an obvious threat
This scam is quieter than an email threatening immediate account deletion. It warns that existing app passwords will no longer work, which suggests that email clients, calendars, or connected devices may suddenly lose access.
That operational inconvenience creates enough pressure to act. A business user may worry about missing messages, while a home user may fear being locked out of Outlook or another mail application.
The button is presented as routine maintenance rather than an emergency rescue. That calm tone can be more convincing than an exaggerated threat because it resembles an ordinary service notification.
4. The button sends the victim away from Microsoft
The “Get a new app password” button contains the malicious destination. The visible label describes a Microsoft security action, but the underlying URL opens infrastructure that is not part of the Microsoft account dashboard.
Attackers frequently place phishing pages on legitimate hosting platforms, shared document services, compromised WordPress sites, and cloud-storage buckets. These services offer reliable HTTPS connections and may initially look less suspicious to filters and users.
The hosting provider’s reputation does not transfer to every file stored there. Anyone evaluating the link must ask who controls the specific page and whether that page is an official location for the requested action.
5. A fake expired session requests the real password
The landing page displays a Microsoft-style sign-in panel and claims that the session has expired. The victim’s email address may already appear in the username field.
This design removes friction. The victim is not asked to choose an account or question why a fresh login is required. They are told that the previous session ended and that re-entering the password is the natural continuation.
The form does not validate the password with Microsoft. It records whatever is typed and sends the data to the scammer’s collection system.
Some phishing kits accept any password and move to the next screen. Others deliberately reject the first entry and ask the victim to try again, allowing criminals to collect two likely passwords in case the first contained a typing error.
6. The attacker tries to sign in immediately
Stolen credentials are often tested within minutes. An automated tool or human operator attempts to sign in to the Microsoft account from a different device or location.
If multifactor authentication is enabled, the attacker may trigger a push notification or one-time code. They may show another fake screen asking the victim to enter that code, or repeatedly send approval prompts in the hope that one is accepted.
Never approve an unexpected sign-in request. A code generated by your authenticator app or sent to your phone is meant for the sign-in you initiated, not for a security check requested by an email page.
Some accounts use older authentication methods, app passwords, weak recovery settings, or reused credentials. In those cases, the attacker may enter without encountering the same protection as a modern interactive sign-in.
7. A compromised mailbox becomes a powerful tool
Access to an Outlook.com or Microsoft 365 mailbox gives criminals more than stored messages. Email is commonly the recovery channel for banking, shopping, social media, cloud storage, and workplace services.
The attacker can search for invoices, identity documents, password-reset messages, customer records, and conversations containing financial details. They may request resets for other accounts and delete the resulting alerts.
Mailbox rules can be created to forward selected messages, hide security warnings, or move replies from a targeted contact. These rules may continue helping the attacker even after the victim changes the password.
Criminals may also send phishing emails from the genuine compromised account. Friends, colleagues, customers, and suppliers are more likely to trust a message that comes from an address they already know.
8. Business email compromise can follow
For a work or school account, the consequences can extend into the organization. The attacker may read internal documents, study payment routines, access shared files, or impersonate an employee in a request to change bank details.
A patient attacker may remain quiet while learning how the business communicates. They can then enter an existing invoice conversation at the right moment and replace legitimate payment instructions with their own.
This is why employees should notify their IT or security team immediately after entering credentials on a suspected phishing page. Resetting the password alone may not remove active sessions, malicious rules, app permissions, or evidence needed for an investigation.
9. The fake page may redirect to hide the theft
After collecting the password, the phishing site may show a generic error or send the victim to a real Microsoft page. The final destination looks legitimate, so the victim may conclude that the update succeeded or that the earlier page was simply part of the process.
This redirect does not make the first page safe. The credential was exposed the moment the victim submitted the fraudulent form.
If anything felt unusual during the sign-in, check browser history and recent Microsoft account activity. Do not wait for visible damage before securing the account.
What To Do If You Have Fallen Victim
If you clicked the link or entered information, stay calm and act in order. The correct response depends on what you did, but a fast password change and account review can prevent a stolen credential from becoming a full account takeover.
-
Close the phishing page and stop interacting with the email. Do not submit the form again, approve a sign-in notification, or reply to the sender. Keep the message temporarily so you can preserve evidence and report it.
If you only opened the email or phishing page and entered nothing, your password was not automatically stolen. The specific campaign is designed primarily to collect credentials. Continue with reporting and a security review, but do not assume that viewing the page alone compromised the account.
-
Change your Microsoft password through the official site. Open a new browser tab and type account.microsoft.com/security yourself. Use a device you trust and create a strong password that you have never used on another account.
Do not return to the email button, even if you want to compare screens. If the attacker changes the account password before you do, use Microsoft’s official sign-in helper or account-recovery process.
-
Review recent sign-in activity. Open the Recent activity section of your Microsoft account and look for unfamiliar devices, countries, IP addresses, successful logins, password changes, and security-information updates.
Mark activity you do not recognize as unauthorized and follow Microsoft’s prompts to secure the account. Save screenshots or notes before removing evidence if the incident affects a business or may require a formal report.
-
Sign out other sessions and check security information. Use Microsoft’s account-security controls to sign out everywhere when that option is available. Review recovery email addresses, phone numbers, aliases, authenticator methods, and trusted devices.
Remove anything you did not add. An attacker who controls a recovery method may regain access after the password is changed.
-
Review and revoke app passwords. In Advanced security options, remove app passwords you do not recognize. If you genuinely use an older application, revoke the old credential and generate a replacement only after the account is secure.
Enter the newly generated app password directly into the intended program. Never send it by email, paste it into a web form reached from a message, or share it with someone claiming to be support.
-
Strengthen multifactor authentication. Confirm that two-step verification is active and that every registered method belongs to you. An authenticator app, security key, or passkey generally provides stronger protection than codes delivered by SMS.
If you approved an unexpected prompt or shared a one-time code, tell Microsoft or your organization’s administrator. Changing the password is essential, but existing sessions and registered authentication methods must also be reviewed.
-
Inspect Outlook rules and forwarding. Check Inbox rules, forwarding settings, connected accounts, automatic replies, signatures, and delegates. Delete any rule or address you did not create.
Look in Sent, Deleted, Archive, Junk, and Recoverable Items for messages the attacker may have sent or hidden. Search for password-reset notices and warnings from other services.
-
Check connected apps and cloud files. Review applications and services that have permission to access your Microsoft account. Revoke unfamiliar permissions and inspect OneDrive or other linked storage for unexpected sharing changes, deleted files, or newly uploaded content.
If sensitive documents were exposed, consider what information they contained and which organizations or people need to be notified.
-
Change every reused password. If the stolen Microsoft password was also used for banking, shopping, social media, work services, or another email account, change those passwords immediately.
Start with your recovery email, financial accounts, mobile carrier, password manager, and accounts containing payment details. Use a different password for every service so one phishing incident cannot unlock several accounts.
-
Tell your employer or school immediately. If the address belongs to an organization, contact the real IT or security team through a known internal channel. Share the time of the click, the page visited, the data entered, and whether you approved an authentication request.
Administrators may need to revoke sessions, reset credentials, review audit logs, remove mailbox rules, inspect OAuth permissions, and warn colleagues about messages sent from the account.
-
Warn contacts if messages were sent from your account. Use another trusted channel when possible. Tell recipients not to open recent links, attachments, payment requests, or shared documents that appear to come from you.
A short, direct warning can prevent the attacker from turning one stolen account into a chain of compromises.
-
Scan the device if anything was downloaded. This campaign primarily uses a web form to steal a password, so a malware infection is not automatic. However, run a full security scan if you downloaded a file, installed an extension, allowed notifications, or launched software from the page.
Remove suspicious browser extensions and review installed applications. If the computer behaves strangely or the attacker obtained remote access, disconnect it from the network and seek professional help.
-
Report the phishing message. In Outlook or Outlook.com, select the email and choose Report, then Report phishing. Microsoft states that this both removes the message and helps improve its filters.
If you use another email client, attach the original message to a new email addressed to phish@office365.microsoft.com. Attach the original rather than simply forwarding it, because the headers are valuable for investigation.
-
Monitor for follow-up attacks. Watch account alerts, password-reset messages, financial statements, and communications from contacts. Attackers may reuse the stolen address in new phishing attempts or pose as a security specialist offering recovery help.
Do not pay anyone who promises to recover an account or stolen data for an upfront fee. Work only through Microsoft, your organization’s administrators, your financial institutions, and law enforcement contacted through independently verified channels.
If you clicked but did not enter a password
Close the page, report the email, and verify account activity through the official Microsoft dashboard. A link click may confirm to the sender that the address is active, so expect additional phishing messages.
You generally do not need to change the password solely because you viewed the fake login page. Change it if the browser filled the password automatically, you submitted any information, or recent account activity shows something unfamiliar.
If your browser autofilled the password
Autofill behavior varies. Some password managers fill a field but do not transmit the value until the form is submitted, while malicious pages can use scripts that capture input in other ways.
If a password appeared on the phishing page, treat it as potentially exposed. Change it from the official account site, review activity, and update any account that reused the same password.
The Bottom Line
The “App Passwords Need to Be Updated” email scam succeeds because its technical story is partly true. App passwords exist, two-step verification is real, and changing a main password can affect older app credentials.
The safe action is still simple: never manage those credentials through a button in an unexpected email. Open your Microsoft account independently and check Advanced security options. If the warning is genuine, the relevant controls will be available there.
If you already entered your password, change it immediately, review recent activity and recovery methods, remove unfamiliar app passwords and mailbox rules, and report the phishing email. Acting quickly can keep a convincing fake alert from becoming a lasting account compromise.
