---
title: New Phishing Attack Targets 200M+ Microsoft 365 Accounts Via Malicious Excel .SLK Files to Bypass Security
description: New Phishing Attack Targets 200M+ Microsoft 365 Accounts Via Malicious Excel .SLK Files to Bypass Security
---

[KnowBe4 Blog ](https://blog.knowbe4.com)

# [New Phishing Attack Targets 200M+ Microsoft 365 Accounts Via Malicious Excel .SLK Files to Bypass Security](https://blog.knowbe4.com/new-phishing-attack-targets-200m-microsoft-365-accounts-via-malicious-excel-.slk-files-to-bypass-security)

 Written by [Stu Sjouwerman](https://blog.knowbe4.com/author/stu-sjouwerman) | Jul 6, 2020 7:10:03 PM

Using an old (but supported) Excel filetype, attackers can bypass both Exchange Online Protection and Advanced Threat Protection to run malicious macros.

Security researchers at [Avanan have discovered a new attack method](https://www.avanan.com/blog/sylkin-attack-bypassing-microsoft-365-security-risking-users) where cybercriminals send phishing emails that contain what appears to be an Excel spreadsheet. The file is actually an SLK file – a “Symbolic Link” Excel file used to transfer data between spreadsheet programs and other databases – to host a macro that launches an MSI script.

There are a few aspects of this attack that make it particularly worrisome for organizations using Microsoft 365:

- The phishing emails are targeted and are written in an organization-specific, and sometimes user-specific manner
- It appears to be an Excel file (because it is) which is a known file format
- Most Office users known not to enable macros (or have them administratively disabled) and, therefore, think it’s fine to open an Excel spreadsheet (“It can’t hurt me, right?”)
- The filetype currently bypasses all Microsoft 365 security
- Windows “Protected View” does not apply to SLK files, so the file is NOT opened in read-only mode, leaving the user vulnerable to attack
- The call to run the Microsoft Installer runs in quiet mode and installs a hacked version of NetSupport remote control

It’s dastardly, a bit brilliant, and VERY dangerous. Users that fall for the initial social engineering scam (again, one that is written specifically for the org and user targeted) will find themselves a victim upon opening the attachment.

Organizations need to first [configure their Microsoft 365 tenant to block these extensions](https://support.microsoft.com/en-us/help/2795329/how-to-block-a-message-from-being-sent-or-received-based-on-the-file-n). But, because the SLK-based attack is just the next attack in a long line of those to come, it’s as important to teach users via [Security Awareness Training](https://www.knowbe4.com/products/enterprise-security-awareness-training/) to be mindful and vigilant with any inbound emails, looking for reasons to suspect they might be malicious in nature.

[View full post](https://blog.knowbe4.com/new-phishing-attack-targets-200m-microsoft-365-accounts-via-malicious-excel-.slk-files-to-bypass-security)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Stu Sjouwerman"
  },
  "dateModified" : "2020-07-11T14:50:51.216Z",
  "datePublished" : "2020-07-06T19:10:03Z",
  "headline" : "New Phishing Attack Targets 200M+ Microsoft 365 Accounts Via Malicious Excel .SLK Files to Bypass Security",
  "image" : {
    "@type" : "ImageObject",
    "height" : 329,
    "url" : "https://www.knowbe4.com/hubfs/SLK.png",
    "width" : 283
  },
  "mainEntityOfPage" : "https://blog.knowbe4.com/new-phishing-attack-targets-200m-microsoft-365-accounts-via-malicious-excel-.slk-files-to-bypass-security",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "KnowBe4 Blog"
  }
}
```