The Drawing Set That Wasn’t: How Fake File-Share Links Take Over Email

Short answer

Fake file-share links can take over a firm’s email by sending staff to a sign-in page that captures their login. Design firms are common targets because they trade drawing sets, bid packages and e-sign requests by link all day. The link may even come from a real consultant whose account was compromised first. MFA helps, but some attacks capture the verification step too, so stronger methods matter. Coverage for resulting losses varies by policy, so review the actual wording.

An email arrives that looks like a normal shared drawing set, bid package or signature request. Attackers often host the lure on real services such as SharePoint or OneDrive, so the link can pass email filters. Security vendors have described this technique, and Trustifi explains how it works with Microsoft 365.

The message may also come from a real consultant’s account that an attacker already controls. Darktrace has described a fake file-share notification sent from a compromised supplier. Because the sender is familiar, the request looks routine.

The attack in four steps

Most of these attacks follow the same order:

The link. A staff member opens a shared document or signature request.
The fake sign-in page. The page looks like Microsoft or another trusted service and asks for a login.
The stolen session. The page captures the password and, in some attacks, the verification code or session as well.
Hidden inbox rules. The attacker sets rules that hide or forward certain emails, then watches the account quietly.

Security researchers have also described e-signature lures that follow this pattern.

The giveaway to watch for

The clearest warning sign is a request to sign in again to view something when you are already signed in. Repeated sign-in prompts deserve the same caution.

When this happens, do not use the link. Open the file service directly in a new browser window, or call the sender on a number you already have to confirm they sent it. The phishing and IT security checklist covers the shared drawing set, the e-sign request and the endless sign-in prompts.

Why a password reset may not be enough

If an attacker captured an active session, changing the password may not end their access right away. The firm should also sign the account out of all sessions and review the account for new inbox rules and forwarding settings.

Firms that suspect a problem should involve their IT provider quickly and notify their insurer or broker as the policy requires.

Why MFA alone may not stop it

Standard MFA still blocks many attacks, so it is worth keeping. Some fake sign-in pages relay the login in real time and capture the code or session. Phishing-resistant MFA, such as passkeys or security keys, is designed to stop most of these attacks. Ask your IT provider whether it is available for your email and file-sharing accounts.

What attackers do after taking over email

Attackers often watch the inbox for invoices and payment conversations. They then send clients “updated wire instructions” from the real account, which makes the request look genuine.

That means the problem can reach beyond the firm. A client may send money to the wrong account because of an email that appeared to come from you.

Real-world example

Consider a hypothetical nine-person civil engineering firm. A project manager receives an email from a surveyor the firm often works with. It says a drawing set is ready and asks her to sign in to view it. She is already signed in to her email, so the prompt strikes her as odd.

She does not click, in calls the surveyor using the number in her contacts. He confirms his account was compromised that morning and he had sent nothing.

If she had signed in, an attacker could have created hidden inbox rules and watched her invoices. A fraudulent payment request could then have reached a client.

What to check in your firm

Firms may want to review:

Whether staff know to open shared files directly instead of through unexpected links.
Whether MFA is on for email and file sharing, and whether phishing-resistant options are available.
Whether the firm knows how to sign an account out of all sessions and check for inbox rules.
Whether any bank detail change requires a callback to a known number.
Whether staff know who to tell right away about a suspicious link.

A compromised email account can lead to costs such as investigation, recovery and notifying clients, depending on the policy. If a fraudster redirects a payment, the loss may fall under social engineering or similar provisions. Some policies address invoice manipulation, where a client sends money to the wrong account because of a hijacked email.

Terms, limits and conditions vary widely. The comparing cyber quotes page shows where to find the client funds and invoice manipulation line. The glossary entry on cyber liability explains the broader coverage.

Hardcover insight

Firms often focus on the dramatic attacks and overlook the ordinary one, a link that looks like a drawing set. Because it fits how design firms already work, it tends to succeed. Teaching staff to question any unexpected sign-in prompt costs little and addresses a common way these incidents start.

How do fake file-share links work?

They send you to a sign-in page that imitates a trusted service. The page captures your login and sometimes your session, which gives an attacker access to your email.

Can a link from a real consultant be fake?

Yes. If the consultant’s account was compromised, the message can come from their real address. Confirm by phone when a request is unexpected.

Is a password reset enough after clicking a fake link?

Not always. A captured session may stay active after a password change. The account should also be signed out of all sessions and checked for inbox rules.

Does MFA stop these attacks?

Standard MFA helps but may not stop every attack. Phishing-resistant methods such as passkeys and security keys are designed to stop most of them.

Does cyber insurance cover a hijacked email account?

It depends on the policy and what happened. Some costs may fall under cyber coverage, while a redirected payment may fall under social engineering or invoice manipulation provisions. Review the wording or ask a broker.