Microsoft Stream 's legacy domain was compromised, resulting in a fake Amazon website promoting casinos in Thailand, causing all SharePoint sites with old embedded videos to display it as spam .
See also: Microsoft fixes Entra ID authentication issue
Microsoft Stream is a video service for businesses that allows organizations to upload and share videos across Microsoft 365, such as Teams and SharePoint.
Video content hosted on Microsoft Stream was accessed or embedded through a portal at microsoftstream.com.
In September 2020, Microsoft announced the retirement of the classic Microsoft Stream service and its migration to SharePoint. Organizations were informed that they would have to migrate their videos from Microsoft Stream to the new platform by April 2024, when the service would be retired.
See also: Microsoft Patch Tuesday July 2024: Fixes for 142 vulnerabilities
The classic Microsoft Stream domain, microsoftstream.com, has been the victim of a scam and displays a website that mimics Amazon, acting as a phishing page for an online casino in Thailand.
It is unclear whether the domain was simply hacked or if the DNS was modified to display the news website, however WHOIS records show that a change was made to the domain on March 27, 2025.
As a result of the hijack, SharePoint servers that still had embedded videos from the classic Microsoft Stream domain were now displaying this spam page on their pages.
This morning, the domain was shut down again, preventing the spam page from appearing on SharePoint. However, Microsoft did not provide any additional information about how the domain was taken over.
Fortunately, the malicious actors behind this breach did not attempt to run a more harmful campaign, such as distributing malware via fake software updates or other messages that would appear on SharePoint servers.
See also: Microsoft: Patch Tuesday December 2023 released
“Spam” refers to unsolicited messages sent in large quantities, mainly via email, but also on other platforms (such as SMS, social networks, or comments on websites). These messages usually come from unknown senders and are intended to either promote products and services, or to deceive recipients for personal or financial gain. Spam messages can be annoying and consume computer or network resources, and may also contain malicious software (malware).
Source: bleepingcomputer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
