When the Phishing Page Lives Inside Microsoft

The link resolved to a Microsoft domain. Valid TLS certificate. Azure hosting behind it. SPF, DKIM, and DMARC all passed. Every reputation check a modern email stack runs came back clean.

That is because the credential-harvesting page was not pretending to live inside Microsoft. It actually did.

The call to action in this message pointed to hxxps://mstexcelauthcopilot[.]powerappsportals[.]com/, a subdomain of powerappsportals[.]com. That parent domain is registered to Microsoft Corporation and has been since 2019. Power Apps Portals (Microsoft's tenant-facing low-code web platform) lets any tenant stand up public pages hosted under that Microsoft domain, served from Azure. Which means an attacker who provisions a tenant can publish an arbitrary page, branded however they like, on infrastructure that carries Microsoft's certificate and reputation for free.

Here, the page advertised "Microsoft Excel Online" and offered buttons labeled Open in Teams and Open in Browser, borrowing the exact visual grammar of a Microsoft collaboration invite. To a finance user, and to a URL scanner, it looked like Microsoft because in every technical sense that reputation systems measure, it was.

The Aging Report That Targeted the Right Person

The lure was mundane by design. Subject line: an accounts-payable "aging report." The kind of routine financial document a controller opens without a second thought. That targeting was not accidental. The recipient was a finance leader, precisely the role with the authority to act on invoices and payments and the habit of clicking through accounting attachments all day.

Delivery is where the second layer of legitimacy came in. The message was sent through SendGrid, a mainstream email service provider, on behalf of premiumaccountshop[.]com, a throwaway domain registered less than a year earlier through an opaque registrar. Because that domain had authorized SendGrid to send on its behalf, the authentication stack validated perfectly: SPF pass, DKIM pass on d=premiumaccountshop[.]com, DMARC pass, compauth=100.

This is the trap in email authentication that never stops catching people. SPF, DKIM, and DMARC confirm that a message genuinely came from the domain in the envelope. They say nothing about whether that domain is trustworthy or whether the content is safe. A freshly registered domain running through a reputable ESP passes authentication exactly as cleanly as your bank does.

Why Reputation Filtering Had Nothing to Block

Sit with the structural problem for a moment. The standard defensive move against a malicious URL is to block the domain or feed it to a reputation service. Neither works here.

You cannot blocklist *.powerappsportals[.]com. The parent is a Microsoft production domain that hosts legitimate customer portals for thousands of organizations. Block it and you break real business workflows. Reputation services return "clean" because the domain's reputation is Microsoft's. The Azure IP behind the page (40[.]112[.]243[.]99) is shared, legitimate cloud hosting. Even the TLS certificate is valid.

This is the defining characteristic of trusted-infrastructure abuse: the attacker does not build their own suspicious infrastructure and try to hide it. They rent legitimacy from a vendor whose reputation is too big to block. It maps cleanly to MITRE ATT&CK T1566.002 (Spearphishing Link) for the delivery and T1656 (Impersonation) for the brand deception, but the technique note that matters is the hosting choice. When the phishing page lives on the vendor's own domain, the entire reputation model inverts. Trust becomes the attack surface.

Microsoft's own threat researchers have documented this shift. The Microsoft Digital Defense Report 2024 describes attackers increasingly hosting phishing content on legitimate cloud and SaaS platforms specifically to defeat domain reputation and URL filtering. The economics are simple: credential theft remains the cheapest path into an organization. IBM's Cost of a Data Breach report has consistently found stolen or compromised credentials among the most common and most expensive initial attack vectors, and the 2024 Verizon Data Breach Investigations Report found stolen credentials involved in 38% of breaches across the full kill chain. A convincing login page on a trusted domain is the whole game.

See Your Risk: Calculate how many threats your SEG is missing

What Actually Caught It

If reputation could not flag this message, something else had to. The signal came from behavior and consensus, not from the domain in the link.

The content told a different story than the branding. A Microsoft-styled Excel and Teams invitation should not arrive from a nine-month-old retail-sounding domain, wrapped in third-party click-tracking redirects that break the visible connection between the Microsoft branding and the real destination. The sender profile, the finance-targeted pretext, and the mismatch between the impersonated service and the actual sending identity were all behavioral tells that a reputation lookup never sees.

That is where Themis, the IRONSCALES agentic AI analyst, resolved the case. Its language and content models scored the message against known phishing patterns, and community intelligence across the IRONSCALES base of 35,000+ security professionals across 17,000+ organizations recognized the campaign shape from resolutions of similar incidents elsewhere. The verdict was credential theft at high confidence, and the message was quarantined before any finance user could reach the portal. Microsoft's own filtering had rated the mail suspicious (SCL=5) but delivered it; the behavioral layer is what pulled it out of the inbox.

The lesson for anyone running Microsoft 365 is uncomfortable but clear: a passing authentication result and a Microsoft-owned destination domain are not evidence of safety. They are exactly the conditions this class of attack is engineered to produce. Defense has to move from "is this domain trusted?" to "does this behavior make sense?" That is the case for layering behavioral, AI-driven detection on top of the native controls, the argument behind M365 augmentation and dedicated credential harvesting protection, and the reason IRONSCALES leans on adaptive behavioral analysis across the platform rather than static reputation alone.

For network defenders working through their own controls, the CISA phishing guidance for stopping the attack cycle remains the practical baseline.

Indicators of Compromise

The uncomfortable part is that five of those six indicators point at infrastructure you cannot simply block. That is the point of the technique, and it is why the domain in a link tells you less and less about whether to trust it.