“Shared a file with you” — then asks you to sign in again

Attackers send genuine OneDrive, SharePoint or Dropbox notifications from real, compromised supplier accounts. The trap is on the other side.

1. Because the notification comes from the real service, it looks legitimate — and it is. The file is the problem.
2. The file is often view-only and asks you to sign in again to see it. That sign-in page steals your password.
3. Unexpected share, even from a supplier you know? Confirm with them by phone first.
4. Open OneDrive or SharePoint directly rather than through the email link.
5. Never enter your password on a page you reached from a shared document.
6. Report the email so others in your business are warned.

Based on: Microsoft Security — File hosting services misused for identity phishing