Users have little reason to doubt the veracity of the emails. “Hackers use SharePoint, OneDrive, AWS, Hubspot, QuickBooks, PayPal to deliver attacks because they are coming from trusted domains and this increases the likelihood they will bypass traditional email technology that relies on blocklist and domain reputation, plus it will look legitimate to employees with security training,” said Patrick Harr, CEO at SlashNext.