The Document Looks Real. The Login Isn’t: How Cloud Collaboration Phishing Targets Campus

A shared document arrives in your inbox.

Maybe it is a job opportunity. Maybe it is a benefits notice, a Montclair announcement, a class-related document, or a file someone says they need you to review.

The message looks routine. The document appears to be hosted on Google Docs, Google Drive, Microsoft OneDrive or another familiar cloud service. Then you are asked to sign in. That seemingly ordinary step can be the beginning of a phishing attack.

Cybercriminals are increasingly using legitimate cloud collaboration platforms as part of phishing campaigns. Rather than sending victims directly to an obviously suspicious website, attackers can use a familiar-looking document as the first step in a chain designed to convince someone to enter their credentials into a fraudulent login page.

For a campus community that relies on cloud services every day, the danger is not simply that a suspicious email might contain a malicious link. The larger problem is that the entire interaction can look legitimate until the moment a password is requested.

How Documents Hide the Threat

Cloud collaboration tools have become an ordinary part of campus life.

Students receive shared files for classes and group projects. Faculty collaborate on research and course materials. Staff exchange forms and documents. Student employees communicate about jobs and opportunities.

Attackers can take advantage of that familiarity.

In recent phishing campaigns, messages have impersonated university-related communications, including HR and benefits notices. Other messages may not pretend to come from a university office at all. A particularly common variation involves fake job opportunities, where an unsolicited message claims to offer employment, an interview, or another opportunity and directs the recipient to a shared document.

The subject matter can change, but the strategy remains similar: Create a believable reason to click. Establish trust. Then ask for credentials.

A document hosted on a legitimate cloud platform can make the first part of that process feel much less suspicious. The important distinction is that a legitimate cloud service does not mean every document or link shared through it is trustworthy.

Why Cloud-Based Phishing Works

People naturally associate familiar technology with safety.

If someone receives a Google Docs sharing notification, they may recognize the design and assume the message is legitimate. The same is true of a OneDrive notification or a document that appears to be connected to Microsoft 365.

But attackers do not necessarily need to compromise those platforms to use them in a phishing campaign.

They can use legitimate services as a delivery mechanism for their message and then place a malicious link inside the document.

That creates an extra layer of credibility.

Instead of:

Suspicious email → suspicious website

the attack may look more like:

Email → familiar cloud document → link inside document → fake university/Microsoft/Google login page

By the time the victim reaches the login page, the original message may not feel suspicious.

The Login Is the Trap

The ultimate goal is often the same as in traditional phishing: steal usernames and passwords.

A shared document may tell the recipient that they need to “sign in to view,” “verify their account,” or “continue” to access the information.

The resulting page may imitate a familiar single sign-on, or SSO, experience.

For a Montclair user, that could mean a page designed to resemble the institution's normal login screen. For another target, it could resemble Microsoft, Google or another service the person uses.

The appearance of the page is meant to answer the question before the victim even asks it:

“This looks like the normal login. Why wouldn't I sign in?”

That is precisely the moment to stop. A login page may look legitimate, but that doesn’t mean it is. If you reached the page through an unexpected email or shared document, take a moment to verify the request before entering your password.

When Job Offers Become Phishing Bait

Not every phishing email will pretend to be from a Montclair department.

Students and employees may also receive messages advertising jobs, internships, remote work or other opportunities. These can be particularly effective because the recipient may already be interested in the opportunity.

A fake job message might direct someone to a shared document containing a job description, application instructions or an offer letter. The document can then send the recipient to a page requesting an account login or personal information.

The attacker does not have to impersonate a recognizable campus office. They simply need to create a convincing reason for someone to click.

That is why it is important to evaluate the entire interaction, not just whether the sender appears to be a university employee. A familiar-looking sender does not make the message, document, or login page safe.

Remember: All official Montclair jobs are available on Handshake.

What should you look for?

There is no single warning sign that identifies every cloud-based phishing attack. Instead, look for combinations of small inconsistencies.

Were you expecting the document?

If someone unexpectedly shares a document with you, especially one involving employment, financial information, account access or other sensitive topics, take a moment before opening it.

An unexpected document is not automatically malicious but it deserves verification.

Does the message create urgency?

Attackers often give recipients a reason to act immediately. A job opportunity may supposedly expire soon. A document may require immediate review. An account may supposedly need verification.

Urgency discourages people from stopping to investigate.

Is the login request unusual?

Ask yourself why a document needs your NetID password.

If an unexpected shared document directs you to a login page, especially one that is different from the normal process you use, do not enter your credentials until you have verified where you are.

Check the destination

Don't judge a website only by its appearance. Look at the address in the browser. Be cautious if the domain does not match the organization or service you expected to use. And remember: a link that begins on a legitimate cloud platform can eventually take you somewhere else.

Verify independently

If a message claims to be from a professor, supervisor, university department, recruiter or employer, contact that person or organization using contact information you already trust.

Do not use the phone number, email address or link supplied in the suspicious message to verify the message itself.

The safest habit: don't let the message choose your login page

One of the most effective defenses against this type of phishing is simple:

Go directly to the service. If an email says you have a new document, access the university’s established system or the official Google or Microsoft service you normally use rather than clicking an unexpected login link.

If the message offers a job opportunity, independently verify that the position is legitimate through the organization’s official website or established recruiting channel.

The goal is to break the attacker's chain.

What happens if you already entered your password?

If you realize that you entered your university credentials into a suspicious page, do not ignore it.

Change your password through the NetID Account Management Center and report the incident using the Phish Alert Button (PAB) or by emailing phishfiles@montclair.edu. If the attack involved a multifactor authentication request, do not approve unexpected authentication prompts.

Reporting a phishing attempt can also help protect other members of the community. A suspicious message that reaches one person's inbox may be sent to hundreds of others.

Familiar technology can still be used for unfamiliar attacks

Cloud collaboration services are not the enemy.

Google Docs, OneDrive, Microsoft 365 and similar platforms are valuable tools that make it easier for students, faculty and staff to work together.

The security lesson is simply that trust in the platform should not automatically become trust in the message.

1. A real Google document can contain a malicious link.
2. A real OneDrive notification can be used as part of a phishing campaign.
3. A fake job opportunity can arrive without any connection to a university office.
4. And a login page can look almost exactly like the one you normally use.

The next time an unexpected document lands in your inbox, don't just ask whether the document looks real. Ask where the link is taking you, why you are being asked to sign in, and whether you can verify the request independently.

The document may be real. The cloud service may be real. The login still might not be.