⚠️ If you received an unexpected RPMSG from an unknown sender, do NOT click any "Read the message" link or enter your Microsoft credentials until you've verified the sender through a separate communication channel (phone call, known chat, etc.).

Why RPMSG Files Are Attractive to Attackers

RPMSG files have one property that makes them extraordinarily valuable to cybercriminals: their content is encrypted and invisible to email security scanners.

Standard email security gateways (SEGs) — tools like Proofpoint, Mimecast, and Microsoft Defender for Office 365 — protect organizations by scanning incoming email content for malicious links, attachments, and phishing patterns. But when content is wrapped in an RPMSG file, the scanner sees only an encrypted blob. It can't read the phishing link inside. It can't detect the fake Microsoft login page waiting on the other end.

By using RPMSG encryption, attackers effectively get a "bypass" for email security infrastructure — and they're using legitimate Microsoft infrastructure to do it.

How RPMSG Phishing Attacks Work (Step by Step)

Step 1: Compromise a Legitimate Microsoft 365 Account

The attack begins with a compromised corporate Microsoft 365 account. Attackers obtain credentials through an earlier phishing campaign, credential stuffing, or purchased breach data. Using a legitimate M365 account is crucial — emails from these accounts have high reputation scores and often bypass spam filters entirely.

Step 2: Craft and Send the RPMSG

The attacker creates an email from the compromised account containing an RPMSG attachment. The email body typically says something like:

"Please find the protected message attached. Click 'Read the message' to view the confidential communication from [company name]."

Because the email comes from a legitimate M365 account with a valid DKIM/SPF signature, it sails through email security gateways. The RPMSG attachment is encrypted — scanners can't inspect its contents.

Step 3: The Victim Authenticates

The victim clicks "Read the message" and is redirected to what appears to be a legitimate Microsoft authentication page. In reality, this is a carefully crafted phishing page hosted on a service with a reputable domain (attackers have used SharePoint, Adobe, and other legitimate cloud services as hosting proxies to further evade detection).

Step 4: Credential Harvesting

When the victim enters their credentials on the fake login page, the attacker captures them in real time. The victim is often redirected to a real (if irrelevant) Microsoft page after submission, so they don't immediately realize they've been compromised.

Step 5: Account Takeover

With the captured credentials, the attacker now has access to the victim's Microsoft 365 account — which they can use for further lateral phishing attacks, accessing sensitive SharePoint files, or selling access to other cybercriminals.

Documented campaigns: RPMSG phishing attacks have been documented by SANS Internet Storm Center, BleepingComputer, SecurityAffairs, Guardz Security, and SpamTitan — confirming this is a widespread, organized threat vector targeting primarily enterprise users.

Red Flags: How to Spot an RPMSG Phishing Email

🚩 Unexpected Encrypted Message

You receive an RPMSG file without expecting any protected communications from this person or organization. Legitimate IRM usage is intentional and usually expected by the recipient (HR communications, legal contracts, board communications).

🚩 Unknown or Suspicious Sender

The "From" name looks familiar (e.g., "Microsoft Support" or "IT Department") but the actual email domain is unfamiliar, slightly misspelled, or from a free email provider.

🚩 Urgency Language

The email creates artificial urgency: "View this confidential document immediately," "Action required within 24 hours," "Your account will be suspended." Legitimate protected business communications rarely have emergency urgency attached.

🚩 Generic Greetings

"Dear Customer," "Dear User," or no greeting at all — rather than your name. Legitimate enterprise IRM emails are usually personalized.

🚩 Login Page URL Doesn't Match

After clicking "Read the message," inspect the URL of the page that appears. Legitimate Microsoft authentication always uses domains ending in .microsoft.com, .live.com, or .microsoftonline.com. Any variation is a phishing page.

How to Protect Yourself

For Individual Users

  • Verify out-of-band — call the sender directly (not reply to the email) to confirm they sent you a protected message before opening it
  • Check the URL carefully — before entering any credentials, verify the login page domain is a legitimate Microsoft domain
  • Enable MFA — Multi-Factor Authentication means a compromised password alone isn't enough for attackers to access your account
  • Use FIDO2/hardware keys — phishing-resistant MFA (hardware security keys) protects even against sophisticated phishing sites that intercept OTP codes
  • Analyze the file first — use our RPMSG viewer to check the file structure and see if the issuer domain matches a legitimate company you'd expect to receive protected mail from

For IT Administrators & Security Teams

  • Deploy Safe Attachments policies — Microsoft Defender for Office 365's Safe Attachments can sandbox suspicious encrypted emails
  • Block external RPMSG files — if your organization doesn't regularly receive external IRM-protected emails, consider blocking .rpmsg attachments from external senders
  • Train end users — run phishing simulation campaigns specifically using RPMSG as a vector to build muscle memory for spotting these attacks
  • Monitor for suspicious RPMSG sending — set up alerts for accounts in your tenant that suddenly start sending large volumes of RPMSG-protected emails (a sign of account compromise)
  • Review Azure AD audit logs — compromised accounts used in RPMSG phishing will show unusual authentication patterns and mail sending activity

If You Think You've Already Been Phished

If you entered your credentials on a suspicious page after opening an RPMSG link, act immediately:

  1. Change your Microsoft account password immediately at account.microsoft.com
  2. Enable MFA if it isn't already active
  3. Review active sessions — in Microsoft account security, look for unfamiliar devices or locations and sign them out
  4. Report to your IT security team — if this is a work account, your IT team needs to know immediately
  5. Report to Microsoft — use the Report Phishing button in Outlook or submit to Microsoft Security Response Center

Summary

RPMSG phishing represents a significant evolution in email-based attacks: using legitimate Microsoft infrastructure and encryption to hide malicious content from security scanners. The key defenses are user awareness (verify unexpected protected emails), URL inspection (never enter credentials on pages with non-Microsoft domains), and technical controls (MFA, Safe Attachments, phishing-resistant auth).

If you received an RPMSG file and want to check its structure before opening, use our free RPMSG viewer — it parses the file entirely in your browser and may extract the issuer domain, helping you verify whether it came from a legitimate organization.