Outlook email via-Groups.outlook.com spam exploit. Adds without consent Groups folder in inbox and additional calanders!.

Microsoft Technical Support Escalation Request

Ticket Type: Infrastructure Vulnerability & Security Escalation Target Tier: Tier 3 Engineering / Exchange Online Core Diagnostics Affected Ecosystem: Outlook.com / Microsoft 365 Shared Architecture

Executive Summary

We have identified and verified a critical infrastructure loophole within the Outlook.com ecosystem that bypasses standard tenant/inbox security controls. The vulnerability leverages trusted internal routing (groups.outlook.com) to force-inject spam and calendar invitations directly into end-user accounts without user interaction or consent options.

Technical Root Cause Analysis (RCA)

1. Domain Trust Abuse: The domain groups.outlook.com is classified as a legitimate internal Microsoft asset. Consequently, standard inbox filters, Transport Rules, and blocklists automatically treat inbound traffic from this domain as trusted.
2. Subdomain Generation Attack Vector: Malicious actors are systematically abusing this architecture by programmatically auto-generating random numeric subdomains (e.g., *.groups.outlook.com, such as 123456789.groups.outlook.com). This variant string bypasses static blocklists.
3. Transport Rule Evasion: Malicious invitations are routed directly into the recipient's Junk Folder. Because user-defined Outlook rules only evaluate and process items executing within the context of the Inbox, they are completely rendered useless against this vector.
4. Calendar Injection Payload: Upon delivery to the Junk folder, the system automatically spawns a persistent individual folder and binds a new calendar instance for every incoming malicious group email. Because the origin domain (groups.outlook.com) cannot be natively blocked by the end user, this leads to an unmitigated user interface flooding of phishing links via calendar appointments.

Required Action & Resolution Pathway

Standard front-line remediation steps (creating rules, blocking addresses, or marking as junk) are entirely ineffective due to the structural nature of this internal routing loophole.

This ticket requires Tier 3 intervention to:

• Investigate systemic abuse vectors targeting the groups.outlook.com infrastructure.
• Review the transport pipeline allowing Junk-routed invitations to automatically spin up calendar events before user confirmation.
• Implement a robust, tenant-side or user-side consent toggle to prevent unauthorized group additions and external calendar modifications from trusted internal domains.

If you want to append more data before submitting this, let me know if you have:

• Specific message headers from the junk emails
• A list of specific subdomains that have targeted your environment

I can formats those directly into a Data Logs section for the engineers.

Microsoft Technical Support Escalation Request

Ticket Type: Infrastructure Vulnerability & Security Escalation
Target Tier: Tier 3 Engineering / Exchange Online Core Diagnostics
Affected Ecosystem: Outlook.com / Microsoft 365 Shared Architecture

Executive Summary

We have identified and verified a critical infrastructure loophole within the Outlook.com ecosystem that bypasses standard tenant/inbox security controls. The vulnerability leverages trusted internal routing (groups.outlook.com) to force-inject spam and calendar invitations directly into end-user accounts without user interaction or consent options.

Technical Root Cause Analysis (RCA)

1. Domain Trust Abuse: The domain groups.outlook.com is classified as a legitimate internal Microsoft asset. Consequently, standard inbox filters, Transport Rules, and blocklists automatically treat inbound traffic from this domain as trusted.
2. Subdomain Generation Attack Vector: Malicious actors are systematically abusing this architecture by programmatically auto-generating random numeric subdomains (e.g., *.groups.outlook.com, such as 123456789.groups.outlook.com). This variant string bypasses static blocklists.
3. Transport Rule Evasion: Malicious invitations are routed directly into the recipient's Junk Folder. Because user-defined Outlook rules only evaluate and process items executing within the context of the Inbox, they are completely rendered useless against this vector.
4. Calendar Injection Payload: Upon delivery to the Junk folder, the system automatically spawns a persistent individual folder and binds a new calendar instance for every incoming malicious group email. Because the origin domain (groups.outlook.com) cannot be natively blocked by the end user, this leads to an unmitigated user interface flooding of phishing links via calendar appointments.

Required Action & Resolution Pathway

Standard front-line remediation steps (creating rules, blocking addresses, or marking as junk) are entirely ineffective due to the structural nature of this internal routing loophole.

This ticket requires Tier 3 intervention to:

• Investigate systemic abuse vectors targeting the groups.outlook.com infrastructure.
• Review the transport pipeline allowing Junk-routed invitations to automatically spin up calendar events before user confirmation.
• Implement a robust, tenant-side or user-side consent toggle to prevent unauthorized group additions and external calendar modifications from trusted internal domains.

If you want to append more data before submitting this, let me know if you have:

• Specific message headers from the junk emails
• A list of specific subdomains that have targeted your environment

I can formats those directly into a Data Logs section for the engineers.

"My account is targeted by a Outlook email via  Groups.outlook.com spam exploit. Automated scripts are force-subscribing my profile to hundreds of malicious directories daily, causing UI freezing. I need a tier-3 engineer to perform an administrative backend flush on my Exchange index to purge all unauthorized external group subscriptions

When an email is received, it bypasses the Microsoft spam filter regardless of the rules applied. Everything from groups.outlook.com is passing through Microsoft spam filter where it is auto sent to junk. From there the junk launched additional Calanders? You cannot block groups.outlook.com therefore bad actors are exposing a bug in the latest offering of Microsoft outlook and outlook 365?

The email is then automatically sent to the Junk folder by the Microsoft junk filter. Once in Junk, these emails automatically create calendar events and invite others to join. All of these activities are malicious, and we have never clicked on them.

Our only current solution is to report them to Microsoft and block each individual sender.

Next, we must open each newly created calendar, locate the first activity, and report each member to Microsoft with an explanation. The next step requires us to click on the sender and leave the group. The core issue is that these malicious spam emails are automatically adding events to our calendar layout.

We have already configured Outlook Mail rules to filter by sender domain, auto-invites, "invited to you" on behalf or of, etc etc not blocking rule has any effect via main body , subject lines, and body text containing phrases used by these malicious actors. Despite this, Outlook still permits the email to pass through to Junk and launch these calendar additions. We urgently need an option to permanently auto-delete all external invitations.

Spammers and malicious actors are exploiting Outlook's default handling of external calendar invitations. Unauthorized senders are injecting spam, fraudulent links, and phishing attempts directly into my Outlook calendar by sending unsolicited meeting invites. These events automatically appear on the calendar layout even before a user interacts with or accepts the invitation.

This exploit bypasses standard email junk filters by placing malicious content directly into the calendar interface, representing a severe breach of user security and a blatant exploitation of Microsoft’s infrastructure.

Crucially, standard mitigation steps are failing due to a persistent settings bug. We have already manually updated the following configurations:

• Turned off automatic processing via "Outlook on the Web > Settings > Calendar > Events from email" by selecting "Don't show event summaries in email or on my calendar."
• Attempted to block automatic invitations in "Settings > Calendar > Invitations" by disabling "Automatically add invitations to my calendar."

However, every time we save, exit, and allow an 8-to-12-hour period to pass, these configurations automatically revert to their default states, allowing the malicious event additions to resume. This indicates a deeper synchronization or policy conflict on the backend.

Requested Actions:

1. Account Review: Please review my account backend to ensure no unauthorized malicious protocols, corrupted cloud syncs, or organization-level policies are forcing these configurations to revert and allowing synchronization events.
2. Mitigation Guidance: Provide the precise configuration steps, or a backend hotfix, for this specific version of Outlook to permanently lock these settings and completely disable the automatic processing and rendering of unaccepted external calendar invitations on my computer.

  "My account is targeted by a Outlook email via  Groups.outlook.com spam exploit. Automated scripts are force-subscribing my profile to hundreds of malicious directories daily, causing UI freezing. I need a tier-3 engineer to perform an administrative backend flush on my Exchange index to purge all unauthorized external group subscriptions

  When an email is received, it bypasses the Microsoft spam filter regardless of the rules applied. Everything from groups.outlook.com is passing through Microsoft spam filter where it is auto sent to junk. From there the junk launched additional Calanders? You cannot block groups.outlook.com therefore bad actors are exposing a bug in the latest offering of Microsoft outlook and outlook 365?

The email is then automatically sent to the Junk folder by the Microsoft junk filter. Once in Junk, these emails automatically create calendar events and invite others to join. All of these activities are malicious, and we have never clicked on them.

Our only current solution is to report them to Microsoft and block each individual sender.

Next, we must open each newly created calendar, locate the first activity, and report each member to Microsoft with an explanation. The next step requires us to click on the sender and leave the group. The core issue is that these malicious spam emails are automatically adding events to our calendar layout.

We have already configured Outlook Mail rules to filter by sender domain, auto-invites, "invited to you" on behalf or of, etc etc not blocking rule has any effect via main body , subject lines, and body text containing phrases used by these malicious actors. Despite this, Outlook still permits the email to pass through to Junk and launch these calendar additions. We urgently need an option to permanently auto-delete all external invitations.

Spammers and malicious actors are exploiting Outlook's default handling of external calendar invitations. Unauthorized senders are injecting spam, fraudulent links, and phishing attempts directly into my Outlook calendar by sending unsolicited meeting invites. These events automatically appear on the calendar layout even before a user interacts with or accepts the invitation.

This exploit bypasses standard email junk filters by placing malicious content directly into the calendar interface, representing a severe breach of user security and a blatant exploitation of Microsoft’s infrastructure.

Crucially, standard mitigation steps are failing due to a persistent settings bug. We have already manually updated the following configurations:

• Turned off automatic processing via "Outlook on the Web > Settings > Calendar > Events from email" by selecting "Don't show event summaries in email or on my calendar."
• Attempted to block automatic invitations in "Settings > Calendar > Invitations" by disabling "Automatically add invitations to my calendar."

However, every time we save, exit, and allow an 8-to-12-hour period to pass, these configurations automatically revert to their default states, allowing the malicious event additions to resume. This indicates a deeper synchronization or policy conflict on the backend.

Requested Actions:

1. Account Review: Please review my account backend to ensure no unauthorized malicious protocols, corrupted cloud syncs, or organization-level policies are forcing these configurations to revert and allowing synchronization events.
2. Mitigation Guidance: Provide the precise configuration steps, or a backend hotfix, for this specific version of Outlook to permanently lock these settings and completely disable the automatic processing and rendering of unaccepted external calendar invitations on my computer.